Case litellm-cve-2026-42271Agent hijackWorldwide
CISA adds actively exploited LiteLLM AI gateway RCE (CVE-2026-42271) to KEV
Attackers exploited command injection in LiteLLM's MCP server preview endpoints, chainable with a Starlette Host bypass for unauthenticated RCE and theft of AI provider keys.
CriticalAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Jun 8, 2026
- Location
- Worldwide
- Target
- BerriAI LiteLLM proxy
- Severity
- Critical
- Triggered by
- Unknown attackers exploiting in the wild
- Actor type
- Unknown
- Reported loss
- None reported
- CVE
- CVE-2026-42271, CVE-2026-48710
What happened
Attackers exploited command injection in LiteLLM's MCP server preview endpoints, chainable with a Starlette Host bypass for unauthenticated RCE and theft of AI provider keys.
Impact: Unauthenticated remote code execution on exposed LiteLLM proxies and theft of stored AI provider keys; number of compromised deployments not disclosed
Who triggered it
Actor: Unknown attackers exploiting in the wild
Attribution: No public attribution; CISA confirmed active exploitation via KEV listing; chain validated by Horizon3.ai
Motive: Takeover of AI gateways and theft of upstream AI provider API keys
How it happened
Attack vector: POST to /mcp-rest/test/connection or /mcp-rest/test/tools/list with a stdio MCP config whose command is spawned as a subprocess; chained with Starlette BadHost (CVE-2026-48710) to skip auth
Root cause: MCP preview endpoints executed user-supplied commands and were exposed to any API key holder; Starlette rebuilt request paths from unvalidated Host headers, letting auth middleware be bypassed
Timeline
- CVE-2026-42271 disclosed in LiteLLM 1.74.2 through 1.83.6
- LiteLLM 1.83.7 restricts MCP test endpoints to PROXY_ADMIN
- Starlette CVE-2026-48710 BadHost disclosed; Horizon3.ai validates unauthenticated chain June 1
- CISA adds CVE-2026-42271 to KEV with federal deadline June 22
Response
BerriAI shipped 1.83.7, Starlette 1.0.1 fixed BadHost; CISA KEV listing with remediation deadline; WAF blocking of the test endpoints advised
Current status: Patched
Sources (open in a new tab)
- The Hacker News thehackernews.com
- Horizon3.ai horizon3.ai
- Wiz Vulnerability Database wiz.io
- Cloud Security Alliance labs.cloudsecurityalliance.org
Cite this case
CISA adds actively exploited LiteLLM AI gateway RCE (CVE-2026-42271) to KEV. AI Threat Watch, case litellm-cve-2026-42271, Jun 8, 2026. https://aithreat.io/cases/litellm-cve-2026-42271/
Permanent link: https://aithreat.io/cases/litellm-cve-2026-42271/