CVE-2026-42271: LiteLLM AI Gateway OS Command Injection via MCP Test Endpoints, Chained to Unauthenticated RCE with CVE-2026-48710 (CISA KEV, Active Exploitation)

CVE-2026-42271 (TL-2026-0730), also tracked as BadHost (chained, CVE-2026-48710), is a critical-severity software vulnerability scored CVSS 8.7, first published 2026-06-09. It has no confirmed attribution, affects BerriAI LiteLLM, references 2 CVEs (CVE-2026-42271, CVE-2026-48710), maps to 19 MITRE ATT&CK techniques (T1005, T1041, T1057), and is covered by 9 detection rules and 15 indicators of compromise.

Key facts for TL-2026-0730

Threat ID
TL-2026-0730
Also known as
BadHost (chained, CVE-2026-48710)
Severity
CRITICAL
CVSS
8.7 (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-06-09
Last reviewed
2026-06-09
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
technology, artificial-intelligence, saas, financial, government, healthcare
Target regions
North America, Europe, Global
Detection rules
9
Indicators of compromise
15

CVE-2026-42271 is an OS command injection flaw (CWE-77/CWE-78) in the open-source BerriAI LiteLLM AI gateway, reachable via the POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list MCP test endpoints, which spawn attacker-supplied command/args/env subprocesses with proxy privileges. Horizon3.ai demonstrated that chaining it with the Starlette 'BadHost' host-header auth bypass (CVE-2026-48710) yields fully unauthenticated remote code execution (effective CVSS 10.0). CISA added it to the Known Exploited Vulnerabilities catalog on June 8, 2026 with a federal remediation deadline of June 22, 2026; it is fixed in LiteLLM v1.83.7.

How CVE-2026-42271 works

CVE-2026-42271 is a critical OS command injection vulnerability in BerriAI LiteLLM, a widely deployed open-source LLM/AI gateway and proxy used to broker requests across model providers. The flaw resides in two Model Context Protocol (MCP) preview/test endpoints — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — that accept a complete MCP server configuration object, including 'command', 'args', and 'env' fields used by the stdio transport. When invoked with a stdio configuration, LiteLLM attempts to establish the connection and spawns the attacker-supplied command as a subprocess on the proxy host, running with the privileges of the LiteLLM proxy process. Because the endpoints performed only API-key authentication with no role/authorization check, any authenticated user — including holders of low-privilege internal-user keys — could execute arbitrary commands on the host.

The vulnerability becomes substantially more dangerous when chained. Horizon3.ai researchers demonstrated that CVE-2026-42271 can be combined with CVE-2026-48710 ('BadHost'), a host-header validation bypass in the Starlette ASGI framework (versions <= 1.0.0) that underpins LiteLLM via FastAPI. BadHost works because Starlette reconstructs request.url by concatenating the raw HTTP Host header with the request path and re-parsing the result; the Host value is not validated against RFC 9112 / RFC 3986 grammar. By injecting characters such as '/', '?', or '#' into the Host header (e.g. 'Host: foo?'), an attacker shifts where path boundaries fall in the reconstructed URL so that request.url.path diverges from the path the ASGI server actually routed against. Security middleware that makes authorization decisions based on request.url rather than the raw ASGI scope path can therefore be bypassed entirely, granting unauthenticated access to the protected MCP test endpoints. The chained exploit eliminates the authentication prerequisite and produces unauthenticated RCE with an effective combined severity of CVSS 10.0.

Successful exploitation enables arbitrary command execution as the LiteLLM proxy process, theft of stored model-provider credentials, API keys and secrets held by the proxy, lateral movement into connected AI infrastructure and downstream systems, and full host compromise. Recommended detection focuses on behavioral telemetry: unexpected child processes spawned by the LiteLLM proxy (shells such as sh/bash, interpreters such as python/node, or network tools such as curl/wget/nc), outbound connections originating from proxy subprocesses to untrusted destinations, anomalous access patterns against /mcp-rest/test/ endpoints, and malformed or unusual HTTP Host header values indicative of BadHost exploitation. CISA added CVE-2026-42271 to the KEV catalog on June 8, 2026 based on confirmed in-the-wild exploitation, setting a June 22, 2026 remediation deadline for U.S. federal civilian agencies. This is the second weaponized LiteLLM flaw within a month, following a March 2026 supply-chain incident in which the actor 'TeamPCP' published malicious LiteLLM packages to PyPI. The fix shipped in LiteLLM v1.83.7-stable, which restricts both test endpoints to users holding the PROXY_ADMIN role and updates the Starlette dependency; Starlette 1.0.1+ additionally validates the Host header.

MITRE ATT&CK techniques used in TL-2026-0730

Collection

T1005 Data from Local System

Exfiltration

T1041 Exfiltration Over C2 Channel

Discovery

T1057 Process Discovery; T1082 System Information Discovery

Execution

T1059 Command and Scripting Interpreter; T1106 Native API

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer

Initial Access

T1190 Exploit Public-Facing Application

Lateral Movement

T1210 Exploitation of Remote Services

Defense Evasion

T1211 Exploitation for Stealth

Impact

T1496 Resource Hijacking

Credential Access

T1528 Steal Application Access Token; T1552 Unsecured Credentials

defense-impairment

T1556 Modify Authentication Process

Resource Development

T1588 Obtain Capabilities

Reconnaissance

T1592 Gather Victim Host Information; T1595 Active Scanning

Affected products and versions in CVE-2026-42271

  • BerriAI — LiteLLM
    Vulnerable versions: >=1.74.2,<1.83.7; 1.74.2 through 1.83.6
    Fixed in: 1.83.7-stable
  • Encode — Starlette
    Vulnerable versions: <=1.0.0
    Fixed in: 1.0.1

Remediation for CVE-2026-42271

Patches

  • LiteLLM v1.83.7-stable (GHSA-v4p8-mg3p-g94g) — adds PROXY_ADMIN authorization on the MCP test endpoints.
  • Starlette 1.0.1+ — validates the HTTP Host header and rejects malformed values (CVE-2026-48710).

Immediate actions

  • Upgrade LiteLLM to v1.83.7-stable or later immediately (restricts MCP test endpoints to PROXY_ADMIN role).
  • Upgrade the Starlette dependency to 1.0.1 or later to close the CVE-2026-48710 BadHost host-header auth bypass.
  • Block POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list at the reverse proxy / API gateway until patched.
  • Rotate all model-provider credentials, API keys, and secrets stored by or reachable from the LiteLLM proxy.
  • Audit logs for unexpected subprocesses spawned by the LiteLLM proxy and for anomalous /mcp-rest/test/ access.

Workarounds

  • Block or remove the POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list endpoints at the gateway.
  • Reject malformed Host headers at the reverse proxy and pin an allowlist of expected Host values.
  • Restrict who can mint LiteLLM API keys and revoke low-privilege internal-user keys that are not required.

Longer-term hardening

  • Deploy EDR with behavioral detection for unexpected child processes of the AI-gateway process.
  • Enforce network segmentation so the LiteLLM host cannot freely reach internal AI infrastructure or the internet.
  • Make all authorization middleware decisions on request.scope['path'] rather than request.url / request.url.path.
  • Remove LiteLLM proxies from direct internet exposure; place behind authenticated gateways and allowlists.
  • Establish a dependency-update SLA for fast-moving AI infrastructure components (LiteLLM, Starlette, FastAPI).

CVEs associated with CVE-2026-42271

CVE-2026-42271, CVE-2026-48710

Weaknesses (CWE) in CVE-2026-42271

CWE-77, CWE-78

Timeline of CVE-2026-42271

  • Actor 'TeamPCP' publishes malicious LiteLLM packages to PyPI in a supply-chain attack — the first of two weaponized LiteLLM issues in the period.
  • CVE-2026-42271 publicly disclosed as an authenticated-only OS command injection via the LiteLLM MCP test endpoints.
  • LiteLLM v1.83.7-stable released, restricting the MCP test endpoints to PROXY_ADMIN role; NVD publishes CVE-2026-42271 (CVSS 4.0 8.7).
  • CVE-2026-48710 'BadHost' Starlette host-header validation bypass publicly disclosed (affects Starlette <= 1.0.0).
  • CSO Online and national CERTs warn that FastAPI/Starlette-based AI tools are exposed to the BadHost authentication bypass.
  • Horizon3.ai confirms CVE-2026-42271 can be chained with CVE-2026-48710 for fully unauthenticated RCE (effective CVSS 10.0).
  • CISA adds CVE-2026-42271 to the Known Exploited Vulnerabilities catalog citing confirmed active in-the-wild exploitation.
  • Help Net Security, The Hacker News, GBHackers and runZero publish exploitation, asset-discovery and detection guidance; NVD last-modified.
  • CISA BOD 22-01 remediation deadline for U.S. federal civilian executive branch agencies to patch CVE-2026-42271.

Sources cited for CVE-2026-42271

Threats related to CVE-2026-42271

Detection coverage for TL-2026-0730

As of 2026-06-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0730 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats