Active Exploitation of LiteLLM Flaw Enables Unauthenticated RCE via Starlette Chain
CISA added CVE-2026-42271 to its Known Exploited Vulnerabilities catalog after evidence emerged that attackers are exploiting a command injection flaw in BerriAI LiteLLM. The bug affects MCP server test endpoints in self-hosted LiteLLM deployments, where crafted stdio parameters can trigger arbitrary command execution on the proxy host. On its own, the flaw requires a valid proxy API key, but researchers reported it is being chained with CVE-2026-48710 in Starlette—a Host header validation bypass known as BadHost—to bypass authentication and achieve unauthenticated remote code execution.
The exposed attack path affects LiteLLM versions 1.74.2 through 1.83.6 when deployed with Starlette 1.0.0 or earlier, and researchers rated the combined chain as effectively critical with a CVSS score of 10.0. Successful compromise can let attackers run OS commands, steal model provider credentials, API keys, secrets, and environment variables, and pivot into connected AI infrastructure. BerriAI patched the issue in LiteLLM 1.83.7 by restricting the vulnerable test endpoints to the PROXY_ADMIN role, while defenders are being urged to upgrade LiteLLM and Starlette, limit network access to the affected endpoints, rotate stored credentials, and review logs for suspicious Host header and subprocess activity.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
4 events from the most recent confirmed update back to the earliest known activity.
CISA adds CVE-2026-42271 to the KEV catalog after active exploitation
CISA added CVE-2026-42271 to its Known Exploited Vulnerabilities catalog after observing evidence of exploitation in the wild. The vulnerability affects LiteLLM MCP server connection-testing endpoints and can lead to command execution on vulnerable proxy hosts.
Horizon3.ai reports LiteLLM-Starlette exploit chain enabling unauthenticated RCE
Horizon3.ai disclosed that CVE-2026-42271 in LiteLLM can be chained with CVE-2026-48710 in Starlette, dubbed "BadHost," to bypass authentication and achieve unauthenticated remote code execution. The company assessed the combined attack path as effectively critical, with exposure of API keys, credentials, and connected AI infrastructure.
BerriAI patches LiteLLM command injection flaw in version 1.83.7
BerriAI fixed CVE-2026-42271 in LiteLLM version 1.83.7 by restricting the vulnerable MCP server test endpoints to the PROXY_ADMIN role. The flaw allowed arbitrary command execution via attacker-supplied stdio parameters on the proxy host.
CISA orders federal agencies to remediate CVE-2026-42271 by June 22
After adding CVE-2026-42271 to the KEV catalog, CISA directed U.S. federal civilian agencies to remediate the LiteLLM command injection vulnerability by 2026-06-22. The order followed confirmation of active exploitation of the flaw.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
4 references tracked. Mallory keeps watching after this page renders.
CISA Warning: LiteLLM Flaw Could Expose Enterprise AI Gateways
techrepublic.com
Open sourceHackers Exploiting LiteLLM RCE Vulnerability in the Wild to Run Arbitrary Commands
cybersecuritynews.com
Open sourceLiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE
thehackernews.com
Open sourceLiteLLM vulnerability under active attack, CISA warns (CVE-2026-42271) - Help Net Security
helpnetsecurity.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
LMDeploy SSRF Was Exploited Within Hours as LiteLLM Proxy Disclosed RCE Chain
Attackers began exploiting **CVE-2026-33626** in LMDeploy less than 13 hours after public disclosure, using a server-side request forgery flaw in vision-language request handling to make inference servers fetch attacker-controlled and internal URLs. Sysdig said the bug affects LMDeploy `0.12.0` and earlier with vision-language support, where `image_url` input is not properly restricted, and observed an eight-minute attack against its honeypot that probed AWS instance metadata, localhost services, an unauthenticated administrative endpoint, and an out-of-band callback domain. The activity included scans of loopback ports associated with **Redis**, **MySQL**, and HTTP services, underscoring the risk of exposing AI inference infrastructure to internal network discovery and cloud credential theft. The disclosures also highlighted broader weaknesses in LLM-serving platforms. LiteLLM published three advisories for LiteLLM Proxy that researchers said can be chained to achieve **remote code execution**, including an unauthenticated SQL injection (`GHSA-r75f-5x8p-qvmc`), a server-side template injection flaw, and an authenticated command-execution issue in MCP stdio test endpoints. The affected LiteLLM range is `1.81.16` through `1.83.6`, with fixes available in `1.83.7-stable` and later, while LMDeploy users were urged to upgrade to `v0.12.3+`, enforce **IMDSv2**, restrict egress, rotate IAM credentials, and monitor inference hosts for requests to metadata, loopback, and private-network addresses.
Apr 24, 2026
LiteLLM Flaws Enable Privilege Escalation and OIDC Authentication Bypass
LiteLLM fixed two high-severity vulnerabilities in version `1.83.0` that could allow attackers to gain elevated access in AI gateway deployments. **CVE-2026-35029** stems from missing admin authorization on the `/config/update` endpoint, allowing an authenticated low-privilege user to change proxy settings and environment variables. The flaw could be abused to register attacker-controlled Python handlers for remote code execution, read arbitrary server files, and overwrite UI credentials to seize privileged accounts, creating broad confidentiality, integrity, and availability risk. The same release also addressed **CVE-2026-35030**, an authentication bypass affecting LiteLLM deployments that enabled JWT-based authentication. In vulnerable versions, the platform used the first 20 characters of a token as the OIDC userinfo cache key, allowing a crafted token with a matching prefix to collide with a legitimate cached session and inherit that user’s identity and permissions. The issue is not enabled by default, limiting exposure to specific configurations, but together the flaws highlight significant access-control weaknesses in LiteLLM versions prior to `1.83.0`.
Apr 29, 2026
Critical LiteLLM SQL Injection Exploited to Target Stored API Keys and Credentials
Attackers began exploiting **CVE-2026-42208** in LiteLLM shortly after public disclosure, using a pre-authentication SQL injection flaw in the product’s `Authorization: Bearer` verification path to query the backend PostgreSQL database without logging in. The vulnerability, also tracked as `GHSA-r75f-5x8p-qvmc`, affects LiteLLM versions **1.81.16 through 1.83.6** and was fixed in **v1.83.7** after the project replaced vulnerable string interpolation with a parameterized query. Sysdig said the first observed exploitation attempt arrived **36 hours and seven minutes** after the advisory was indexed, with activity focused on enumerating high-value tables holding virtual API keys, provider credentials, verification tokens, and environment-based configuration. Researchers described the intrusion attempts as targeted rather than opportunistic, citing knowledge of Prisma-generated PostgreSQL table names and `UNION`-based column discovery; while no confirmed follow-on abuse was observed, defenders are being urged to patch exposed instances immediately, rotate all stored secrets, and review logs and billing accounts for signs of compromise.
May 11, 2026