CVE-2026-42271 — BerriAI LiteLLM: Command Injection | CVSS 8.7 HIGH

HIGH

CVSS 8.7 HIGH  ·  EPSS 4%  ·  BerriAI LiteLLM

Severity Overview

Summary

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host. This issue has been patched in version 1.83.7.

What the Attack Looks Like

How it works: Attacker-controlled data is embedded in a command passed to a shell or interpreter without sufficient escaping, causing unintended commands to execute alongside the intended one.

Analyst Takeaway

The attack is launched over the network (remotely exploitable without physical access) and low-privileged credentials are required. This vulnerability is already in CISA KEV, which means exploitation has been confirmed in the wild — treat this as active risk, not theoretical exposure. The CVSS score is high enough to justify expedited remediation, especially for exposed systems or assets that handle sensitive data. The ATT&CK mapping suggests public-facing exploitation risk, so external exposure validation should be part of immediate triage. In parallel with patching, defenders should review external exposure, hunt for signs of exploitation, and validate whether compensating controls are in place for vulnerable assets.

MITRE ATT&CK Mapping

• T1190 – Exploit Public-Facing Application
  Rationale: The product appears likely to be internet-facing or commonly exposed in enterprise environments.

Detection Guidance

• CWE-77 — Command Injection
  • Input log inspection: Search application logs and WAF telemetry for shell metacharacters in user-controlled fields: semicolons (;), pipes (|), ampersands (&), backticks, $(, %0a (newline), and their URL-encoded equivalents.
  • Process telemetry: Hunt for shell processes (bash, sh, cmd.exe, PowerShell) spawned as children of the web or application process. A web server that spawns a shell is a near-certain exploitation indicator.
  • Command execution artifacts: Look for evidence of commands running that the application would never normally execute — network tools (curl, wget, nc, ncat), file modification outside the app directory, or user account creation.
• T1190 — Exploit Public-Facing Application
  • Inspect web server, reverse proxy, load balancer, and WAF logs for abnormal request patterns — unusual URIs, oversized payloads, HTTP verb abuse, or encoding anomalies.
  • Monitor for spikes in HTTP 4xx/5xx responses that may indicate probing or failed exploitation attempts preceding a successful hit.
  • Review outbound connections from affected servers for unexpected command-and-control callbacks or secondary payload retrieval to external IPs.
  • Validate which internet-facing assets are running the vulnerable version and verify whether compensating controls (WAF rules, network ACLs) are in place and effective.

Hunting Considerations

These are proactive hunts mapped to the ATT&CK techniques identified for this CVE. Run them now — do not wait for an alert to fire.

• T1190 — Exploit Public-Facing Application
  • Web/app server logs: Search for unusual HTTP methods, requests to non-standard paths, oversized payloads, or encoding anomalies (URL-encoded or double-encoded sequences) targeting the vulnerable application. Cluster by source IP and look for low-volume probing patterns before any successful hit.
  • Process telemetry: Hunt for child processes spawned by the web server or application process (e.g., apache2, nginx, w3wp.exe, java). Web server processes should not be launching shells, scripting engines (PowerShell, bash, python), or download utilities.
  • Outbound connections from the server: Alert on unexpected outbound HTTP/S or DNS from the application server to external IPs not in your CDN or update allowlist — this is a common secondary payload retrieval indicator post-exploitation.
  • File system writes: Look for new files written to web root directories, temp folders, or cron directories by the application process — especially scripts or executables placed there after an unusual inbound request.
  • Internal pivot follow-on: After gaining a foothold, attackers move laterally. Search for new internal connections originating from the compromised server in the hour following any suspicious external request.

Recommended Actions

Immediate (0–24 Hours)

• Inventory: Identify all systems running BerriAI LiteLLM. Include production, staging, dev, and cloud environments — untracked instances are the most likely to remain unpatched.
• Validate internet-facing exposure: Determine which of the affected systems are reachable from the public internet. Prioritize these for immediate remediation or compensating controls.

Remediation

• Apply the vendor patch: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
• CISA directive deadline: 2026-06-22 — this is the mandatory deadline for US federal civilian agencies under BOD 22-01. All organizations should treat this date as a strong target regardless of federal mandate.
• Verify remediation: After patching, confirm the correct version is installed on all affected hosts. Run a vulnerability scan or use your asset management tooling to verify — do not rely solely on change tickets.
• Post-patch review: After patching, review web server and application logs for signs of exploitation prior to remediation. A successful exploit may have left behind a web shell, new account, or scheduled task.

Detection Coverage

• Verify ATT&CK coverage: Confirm your SIEM and EDR have detection logic in place for T1190. Review the Detection Guidance and Hunting Considerations sections of this alert for the specific log sources and behavioral patterns to monitor.
• Threat intelligence feeds: Monitor your TI feeds and vendor advisory channels for published indicators of compromise (IOCs), proof-of-concept exploit releases, or active campaign reporting associated with this CVE — these should trigger an immediate hunt even if no internal alerts have fired.

Vulnerability Details

Additional Notes

This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g ; https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable ; https://nvd.nist.gov/vuln/detail/CVE-2026-42271