LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE
CISA added a LiteLLM command-injection bug to its exploited-vulnerabilities list after signs of active abuse. Researchers say it can chain with a Starlette auth bypass to reach unauthenticated RCE.
Intelligence analysis by GPT-5.4 Mini
CISA says CVE-2026-42271 in BerriAI LiteLLM is being exploited, and BerriAI has patched it in version 1.83.7. Horizon3.ai says it can pair with a Starlette host-header bypass to turn authenticated command execution into unauthenticated RCE.
A gatekeeper tool for AI servers had a broken side door. A thief could send a fake setup and make the machine run their own command, like sneaking a note into a printer and making it print secret files.
Analysis
What happened
CISA added CVE-2026-42271 to its Known Exploited Vulnerabilities catalog, saying there is evidence the LiteLLM flaw is being actively exploited. The bug affects LiteLLM Python package versions >= 1.74.2 < 1.83.7.
According to BerriAI, two preview endpoints for MCP servers accepted a full server configuration in the request body, including command, args, and env. When those endpoints were used with a stdio configuration, LiteLLM tried to connect and spawned the supplied command as a subprocess on the proxy host. BerriAI says the endpoints were protected only by a valid proxy API key, so any authenticated user could trigger command execution.
Why the chain is worse
Horizon3.ai reported that CVE-2026-42271 can be chained with CVE-2026-48710, a Starlette host-header validation bypass nicknamed "BadHost." In deployments using Starlette versions <= 1.0.0, that bypass can defeat LiteLLM authentication entirely. Horizon3.ai says this turns the issue into unauthenticated remote code execution.
The article says a successful attack could let an adversary run arbitrary commands on the LiteLLM host, steal model provider credentials, take API keys and secrets stored by the proxy, move laterally into connected AI systems, and potentially compromise downstream services tied to the gateway.
Mitigation
BerriAI released fixes in LiteLLM 1.83.7, where the test endpoints now require the PROXY_ADMIN role. The article also recommends upgrading Starlette to 1.0.1 or later, blocking the two test endpoints at the reverse proxy or API gateway, limiting access to trusted networks, rotating proxy-stored credentials, and reviewing logs for unusual Host header activity and subprocess launches.
Key points
- CISA added CVE-2026-42271 in LiteLLM to its Known Exploited Vulnerabilities catalog.
- BerriAI says the flaw lets authenticated users trigger arbitrary commands on the proxy host.
- Horizon3.ai says it can chain the bug with a Starlette host-header bypass to reach unauthenticated RCE in some deployments.
- The recommended fixes are LiteLLM 1.83.7+ and Starlette 1.0.1+.
- Mitigations include blocking the affected endpoints, restricting access, rotating credentials, and reviewing logs.
LiteLLM users who upgrade to 1.83.7 or later get the command-injection bug patched, and the test endpoints now need a stronger role. If teams also update Starlette and lock down network access, the exploit chain described by researchers should be much harder to use.
Deployments that stay on older LiteLLM or Starlette versions may remain exposed to command execution, credential theft, and broader compromise of connected AI infrastructure. Because CISA has already flagged active exploitation, unpatched systems may be targeted before operators notice unusual Host header or subprocess activity.
