CISA adds CVE‑2026‑42271 command‑injection to KEV
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- CISA added CVE‑2026‑42271 to its KEV catalog, labeling it high severity (CVSS 8.7) and citing evidence of active exploitation.
- LiteLLM versions 1.74.2 through 1.83.6 are vulnerable to command injection via the POST /mcp‑rest/test/connection and POST /mcp‑rest/test/tools/list endpoints, which spawn supplied commands as subprocesses on the proxy host.
- BerriAI said the vulnerable endpoints were protected only by a valid proxy API key, so any authenticated user—including privileged internal keys—could execute arbitrary commands.
- CVE‑2026‑42271 was patched in LiteLLM 1.83.7, which now requires the PROXY_ADMIN role for the test endpoints, aligning them with the save endpoint’s protection.
- Horizon3.ai reported chaining CVE‑2026‑42271 with CVE‑2026‑48710 (a Starlette host‑header validation bypass) to bypass authentication entirely, yielding a combined CVSS of 10.0.
- Starlette versions ≤ 1.0.0 are vulnerable to the host‑header bypass, enabling unauthenticated remote code execution against LiteLLM deployments that depend on them.
Why it matters: Enterprises and developers using LiteLLM must upgrade to version 1.83.7 or later, or risk remote command execution by any authenticated user and, via the Starlette bypass, unauthenticated attackers. The KEV listing indicates active exploitation, urging immediate mitigation to protect model provider credentials and downstream AI infrastructure.
