CVE-2026-42271: BerriAI LiteLLM MCP Preview Command Injection (KEV)

CVE-2026-42271 is a command injection in LiteLLM, a popular open-source AI gateway/proxy server: two endpoints meant to preview an MCP server before saving it accept a full stdio launch configuration and spawn it as a subprocess on the proxy host, so any authenticated proxy user — regardless of role — can run arbitrary commands on the host, and CISA added it to the Known Exploited Vulnerabilities catalog.

CVE-2026-42271 affects LiteLLM, an AI gateway/proxy server used to call LLM APIs in an OpenAI-compatible format. From version 1.74.2 up to (but not including) 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check, so any authenticated user — including holders of low-privilege internal-user keys — could run arbitrary commands on the host (NVD).

NVD has analyzed this CVE and published its own Primary CVSS v3.1 score of 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, requiring only low (authenticated) privileges and no user interaction, with high impact to confidentiality, integrity and availability. GitHub's own advisory additionally scores it CVSS v4.0 8.7. CWE-77/CWE-78 (command injection / OS command injection) are the assigned weaknesses (NVD).

The GitHub Security Advisory (GHSA-v4p8-mg3p-g94g) confirms the technical detail and states the fix fully patches the issue by restricting the two preview endpoints to users holding the PROXY_ADMIN role, aligning their access control with the existing MCP-server save endpoint. As an interim workaround for installations that cannot upgrade immediately, it recommends blocking both endpoints at the reverse proxy or API gateway (GitHub Advisory GHSA-v4p8-mg3p-g94g).

CISA added CVE-2026-42271 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-06-08, with a required-action due date of 2026-06-22, and records knownRansomwareCampaignUse as "Unknown" (CISA KEV).

As of 2026-10-30, FIRST scores the probability of exploitation at 0.9144 (99.812th percentile) — an unusually high score reflecting that internet-exposed LiteLLM proxy deployments, increasingly common as teams stand up internal AI gateways, are actively targeted (FIRST EPSS).

Any LiteLLM proxy deployment between 1.74.2 and 1.83.6 should be upgraded to 1.83.7 or later immediately; teams that cannot upgrade right away should block the two MCP preview endpoints at the reverse proxy and audit which API keys have been used against them.

• The MCP-server preview endpoints accept a full stdio server configuration (command, args, env) and spawn it as a subprocess on the proxy host, gated only by a valid API key with no role check, letting any authenticated user run arbitrary commands. — NVD
• NVD Primary CVSS v3.1 base score is 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; GitHub's own advisory separately scores it CVSS v4.0 8.7. — NVD
• Affected: LiteLLM 1.74.2 through 1.83.6; fixed in 1.83.7, which restricts the preview endpoints to the PROXY_ADMIN role. Interim workaround: block the endpoints at the reverse proxy/API gateway. — GitHub Advisory GHSA-v4p8-mg3p-g94g
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-06-08, required action due 2026-06-22; knownRansomwareCampaignUse recorded as "Unknown". — CISA KEV
• EPSS score is 0.9144 (99.812th percentile) as of 2026-10-30. — FIRST EPSS