Security1 hSeptember 30, 2026, 19:20

CVE-2026-42271 in LiteLLM: RCE via MCP test endpoints

In LiteLLM 1.74.2–1.83.6, MCP test endpoints checked only for a valid API key, with no role check, and launched arbitrary commands via the stdio transport. CISA added CVE-2026-42271 to its Known Exploited Vulnerabilities catalog on June 8, 2026; patch 1.83.7 requires the PROXY_ADMIN role and adds a command allowlist.

DEV Community

Open source

CVE-2026-42271 in LiteLLM: RCE via MCP test endpoints

Affected range: LiteLLM 1.74.2 up to 1.83.7, fix in 1.83.7
CVSS 8.8 (v3.1) and 8.7 (v4.0), exploited in the wild
Official Docker images run the proxy as root
Attack chain also uses CVE-2026-59822 and CVE-2026-48710

#LiteLLM#CISA

CVE-2026-48710 (BadHost): malformed Host header bypasses Starlette path authorization

Security

vCenter Syslog directory traversal CVE-2026-59310 exploited for RCE

Security

LiteLLM auth bypass: a one-character token unlocked MCP tools

Security

CVE-2026-42271 in LiteLLM: RCE via MCP test endpoints

CVE-2026-48710 (BadHost): malformed Host header bypasses Starlette path authorization

vCenter Syslog directory traversal CVE-2026-59310 exploited for RCE

LiteLLM auth bypass: a one-character token unlocked MCP tools

The AI Gateway Is Now a Credential Hub: What the LiteLLM MCP Authentication Bypass Means for Self-Hosted LLM Infrastructure