LiteLLM: From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before…
LiteLLM
More for LiteLLM RSS feed for LiteLLM
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-42271
- Affects
- LiteLLM
- Known exploited
- Yes, listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 8, 2026
- Source last modified
- October 26, 2026
Description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host. This issue has been patched in version 1.83.7.
Description quoted from the NVD record.
Who is affected
LiteLLM, made by BerriAI, is a service that sits between your organization's apps and AI language model providers. This flaw affects versions 1.74.2 up to, but not including, 1.83.7. It is in the feature that lets users test a connection to a tool server (a service that gives AI models extra abilities) before saving it. Anyone with a valid LiteLLM access key, even a low-level internal user key, could use it to run any commands they choose on the computer that runs LiteLLM. This flaw is rated High. It is on CISA's Known Exploited Vulnerabilities list, which means attacks using it have been seen.
What to do
- Find out who looks after LiteLLM for your organization: the person who installed or runs it, or the IT provider or vendor who manages it for you.
- Have that person check which version is running. Versions 1.74.2 up to, but not including, 1.83.7 have this flaw.
- If you run LiteLLM yourself, update it to version
1.83.7, the release that fixes this flaw. - If an IT provider or vendor runs it, send them this advisory and ask when the update will be done.
- Treat this update as urgent, because attacks using this flaw have been seen.
Analysis written from the source record as of October 26, 2026 and reviewed before publishing.