Summary
generated automatically from NVD dataLiteLLM, the LLM proxy server (AI Gateway), has a command injection flaw (CWE-77) in versions from 1.74.2 before 1.83.7. The MCP preview endpoints POST /mcp-rest/test/connection and /mcp-rest/test/tools/list accept a stdio configuration and spawn its command on the proxy host, requiring only a valid proxy API key with no role check. Any authenticated user can run arbitrary commands, and the flaw is listed in CISA's KEV catalog. It is rated 8.8 (HIGH, CVSS v3.1) and patched in 1.83.7.
NVD description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host. This issue has been patched in version 1.83.7.
⚠️ Actively exploited — CISA KEV
This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-08. It is confirmed exploited in the wild and must be patched as a priority.
Remediation deadline (US federal agencies): 2026-06-22
EPSS · FIRST.org
92.6%probability of exploitation in the next 30 days
Higher than 99% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 8 mai 2026
- Updated
- 15 juil. 2026
- Status
- Analyzed
- Source
- security-advisories@github.com
Affected products
Weaknesses (CWE)
References (9)
- https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stableProductRelease Notes
- https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94gMitigationPatchVendor Advisory
- https://access.redhat.com/errata/RHSA-2026:27784Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:28960Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:30056Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-42271Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2467924Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42271.jsonThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42271US Government Resource
Similar CVEs
Other vulnerabilities of type CWE-77
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.