Reference page — cumulative record through Tuesday, October 6, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-42271

CVE-2026-42271HIGH

BerriAI litellm — LiteLLM: Authenticated command execution via MCP stdio test endpoints

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   L   N   H   H   H    8.7   .9257   99.8   YES

AFFECTED
  Product  Versions               Fixed
  litellm  >= 1.74.2, < 1.83.7 –  —

TIMELINE
  Apr 26  Reserved by GitHub_M
  May 8   Published (CNA: GitHub_M)
  Jun 8   Added to CISA KEV, remediation due 2026-06-22
  Jun 23  DUE DATE PASSED — CVE-2026-42271 (BerriAI LiteLLM). CISA remediation deadline was June 22, 2026; still in catalog.

CWE-77, CWE-78 · CNA: GitHub_M · CVSS v4.0 · 9 references · KEV due June 22, 2026

Description

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host. This issue has been patched in version 1.83.7.

Lifecycle

Complete event history — 4 events, chronological
Date	Event	Detail
April 26, 2026	Reserved	Reserved by GitHub_M
May 8, 2026	Published	Published (CNA: GitHub_M)
June 8, 2026	KEV ADDED	Added to CISA KEV, remediation due 2026-06-22
June 23, 2026	DUE DATE PASSED	DUE DATE PASSED — CVE-2026-42271 (BerriAI LiteLLM). CISA remediation deadline was June 22, 2026; still in catalog.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
BerriAI	litellm	—	>= 1.74.2, < 1.83.7	—

Weaknesses

CWE-77 · CWE-78

References (9)

https://access.redhat.com/errata/RHSA-2026:27784 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:28960 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:30056 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/security/cve/CVE-2026-42271 [vdb-entry, x_refsource_REDHAT]
https://bugzilla.redhat.com/show_bug.cgi?id=2467924 [issue-tracking, x_refsource_REDHAT]
https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable [x_refsource_MISC]
https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g [x_refsource_CONFIRM]
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42271.json [x_sadp-csaf-vex]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42271 [government-resource]

Authoritative record: CVE-2026-42271 at cve.org

Vendors: berriai

Weaknesses: CWE-77 · CWE-78

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-42271 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Tuesday, October 6, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.