CVE-2026-42271

Name of the Vulnerable Software and Affected Versions LiteLLM versions 1.74.2 through 1.83.6

Description A command injection flaw exists in LiteLLM, a proxy server for Large Language Model APIs. The endpoints 'POST /mcp-rest/test/connection' and 'POST /mcp-rest/test/tools/list', used to preview an MCP server, accept a full server configuration in the request body. Specifically, the command, args, and env variables used by the stdio transport can be manipulated. When a stdio configuration is provided, the server spawns the supplied command as a subprocess on the proxy host with the privileges of the proxy process. Because these endpoints only require a valid proxy API key and lack role-based access control, any authenticated user, including those with low-privilege internal-user keys, can execute arbitrary commands on the host. This issue has been actively exploited in the wild.

Recommendations Update to version 1.83.7. As a temporary workaround, block the 'POST /mcp-rest/test/connection' and 'POST /mcp-rest/test/tools/list' endpoints at the reverse proxy or API gateway.