39,155 Exposed LiteLLM Deployments Found on the Internet

A ZoomEye query matching the LiteLLM fingerprint returned 39,155 internet-reachable assets, including 9,792 in the US and 2,629 in China. CVE-2026-42271 in LiteLLM 1.74.2 through 1.83.7 let low-privilege keys run commands via MCP test endpoints; CISA added it to the Known Exploited Vulnerabilities catalog on June 8, 2026.

• ZoomEye found 39,155 assets matching the LiteLLM fingerprint
• US accounts for 9,792, China 2,629, Japan 2,030, India 1,855
• CVE-2026-42271 affects LiteLLM 1.74.2–1.83.7, fixed in 1.83.7
• CISA added the flaw to its exploited vulnerabilities list on June 8, 2026