# CVE-2026-42271: LiteLLM AI Gateway OS Command Injection via MCP Test Endpoints, Chained to Unauthenticated RCE with CVE-2026-48710 (CISA KEV, Active Exploitation)

> CVE-2026-42271 is an OS command injection flaw (CWE-77/CWE-78) in the open-source BerriAI LiteLLM AI gateway, reachable via the POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list MCP test endpoints, which spawn attacker-supplied command/args/env subprocesses with proxy privileges. Horizon3.ai demonstrated that chaining it with the Starlette 'BadHost' host-header auth bypass (CVE-2026-48710) yields fully unauthenticated remote code execution (effective CVSS 10.0). CISA added it to the Known Exploited Vulnerabilities catalog on June 8, 2026 with a federal remediation deadline of June 22, 2026; it is fixed in LiteLLM v1.83.7.

- **Published:** 2026-06-09T00:00:00Z
- **Last reviewed:** 2026-06-09T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0730
- **ID:** TL-2026-0730
- **Severity:** CRITICAL (CVSS 8.7)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-42271, CVE-2026-48710

## Description

CVE-2026-42271 is a critical OS command injection vulnerability in BerriAI LiteLLM, a widely deployed open-source LLM/AI gateway and proxy used to broker requests across model providers. The flaw resides in two Model Context Protocol (MCP) preview/test endpoints — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — that accept a complete MCP server configuration object, including 'command', 'args', and 'env' fields used by the stdio transport. When invoked with a stdio configuration, LiteLLM attempts to establish the connection and spawns the attacker-supplied command as a subprocess on the proxy host, running with the privileges of the LiteLLM proxy process. Because the endpoints performed only API-key authentication with no role/authorization check, any authenticated user — including holders of low-privilege internal-user keys — could execute arbitrary commands on the host.

The vulnerability becomes substantially more dangerous when chained. Horizon3.ai researchers demonstrated that CVE-2026-42271 can be combined with CVE-2026-48710 ('BadHost'), a host-header validation bypass in the Starlette ASGI framework (versions <= 1.0.0) that underpins LiteLLM via FastAPI. BadHost works because Starlette reconstructs request.url by concatenating the raw HTTP Host header with the request path and re-parsing the result; the Host value is not validated against RFC 9112 / RFC 3986 grammar. By injecting characters such as '/', '?', or '#' into the Host header (e.g. 'Host: foo?'), an attacker shifts where path boundaries fall in the reconstructed URL so that request.url.path diverges from the path the ASGI server actually routed against. Security middleware that makes authorization decisions based on request.url rather than the raw ASGI scope path can therefore be bypassed entirely, granting unauthenticated access to the protected MCP test endpoints. The chained exploit eliminates the authentication prerequisite and produces unauthenticated RCE with an effective combined severity of CVSS 10.0.

Successful exploitation enables arbitrary command execution as the LiteLLM proxy process, theft of stored model-provider credentials, API keys and secrets held by the proxy, lateral movement into connected AI infrastructure and downstream systems, and full host compromise. Recommended detection focuses on behavioral telemetry: unexpected child processes spawned by the LiteLLM proxy (shells such as sh/bash, interpreters such as python/node, or network tools such as curl/wget/nc), outbound connections originating from proxy subprocesses to untrusted destinations, anomalous access patterns against /mcp-rest/test/ endpoints, and malformed or unusual HTTP Host header values indicative of BadHost exploitation. CISA added CVE-2026-42271 to the KEV catalog on June 8, 2026 based on confirmed in-the-wild exploitation, setting a June 22, 2026 remediation deadline for U.S. federal civilian agencies. This is the second weaponized LiteLLM flaw within a month, following a March 2026 supply-chain incident in which the actor 'TeamPCP' published malicious LiteLLM packages to PyPI. The fix shipped in LiteLLM v1.83.7-stable, which restricts both test endpoints to users holding the PROXY_ADMIN role and updates the Starlette dependency; Starlette 1.0.1+ additionally validates the Host header.

## MITRE ATT&CK

- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1068 Exploitation for Privilege Escalation
- T1556 Modify Authentication Process
- T1211 Exploitation for Stealth
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1082 System Information Discovery
- T1057 Process Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1496 Resource Hijacking

## Sources

- [LiteLLM vulnerability under active attack, CISA warns (CVE-2026-42271)](https://www.helpnetsecurity.com/2026/06/09/litellm-vulnerability-under-active-attack-cisa-warns-cve-2026-42271/)
- [GitHub Security Advisory GHSA-v4p8-mg3p-g94g (LiteLLM command injection)](https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g)
- [CVE-2026-42271: LiteLLM Unauthenticated RCE (chained with CVE-2026-48710)](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-42271-chained-with-cve-2026-48710/)
- [LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE](https://thehackernews.com/2026/06/litellm-flaw-cve-2026-42271-exploited.html)
- [NVD - CVE-2026-42271](https://nvd.nist.gov/vuln/detail/CVE-2026-42271)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [LiteLLM v1.83.7-stable Release](https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable)
- [Disclosing the BADHOST Vulnerability in Starlette - OSTIF.org](https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette/)
- [BadHost - CVE-2026-48710 Starlette Host-Header Auth Bypass](https://badhost.org/)
- [LiteLLM Proxy vulnerabilities: How to find impacted assets (runZero)](https://www.runzero.com/blog/litellm/)
- [LiteLLM Vulnerability Allows Attackers to Execute Arbitrary Commands on Servers (GBHackers)](https://gbhackers.com/litellm-vulnerability/)
- [FastAPI-based AI tools exposed to authentication bypass by flaw in Starlette framework (CSO Online)](https://www.csoonline.com/article/4177711/fastapi-based-ai-tools-exposed-to-authentication-bypass-by-flaw-in-starlette-framework.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0730