Active Exploitation of LiteLLM Flaw Enables Unauthenticated RCE via Starlette Chain

CISA added CVE-2026-42271 to its Known Exploited Vulnerabilities catalog after evidence emerged that attackers are exploiting a command injection flaw in BerriAI LiteLLM. The bug affects MCP server test endpoints in self-hosted LiteLLM deployments, where crafted stdio parameters can trigger arbitrary command execution on the proxy host. On its own, the flaw requires a valid proxy API key, but researchers reported it is being chained with CVE-2026-48710 in Starlette—a Host header validation bypass known as BadHost—to bypass authentication and achieve unauthenticated remote code execution.

The exposed attack path affects LiteLLM versions 1.74.2 through 1.83.6 when deployed with Starlette 1.0.0 or earlier, and researchers rated the combined chain as effectively critical with a CVSS score of 10.0. Successful compromise can let attackers run OS commands, steal model provider credentials, API keys, secrets, and environment variables, and pivot into connected AI infrastructure. BerriAI patched the issue in LiteLLM 1.83.7 by restricting the vulnerable test endpoints to the PROXY_ADMIN role, while defenders are being urged to upgrade LiteLLM and Starlette, limit network access to the affected endpoints, rotate stored credentials, and review logs for suspicious Host header and subprocess activity.