LiteLLM, a widely used routing proxy for large language models, contains a critical vulnerability that allows authenticated users to execute arbitrary commands on the host machine. The flaw exists within two test endpoints, POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list, which were designed to verify Model Context Protocol (MCP) server configurations. As BerriAI noted in their advisory: “Two endpoints used to preview an MCP server before saving it – POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list – accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process.”
The security failure stems from an overly permissive trust model. These endpoints required only a valid proxy API key, with no additional checks to verify if the user had the necessary permissions to perform such sensitive operations. Consequently, any user with access to the proxy—even those holding low-privilege internal keys—could trigger command execution. This design choice effectively treated internal testing features as safe for production environments without implementing proper access restrictions. The fix, released in version 1.83.7, now mandates the PROXY_ADMIN role for both test endpoints, ensuring that only authorized administrators can interact with them.
The severity of this vulnerability increases dramatically when combined with CVE-2026-48710, a host header validation bypass affecting Starlette versions 1.0.0 and below. By exploiting this bypass, an attacker can circumvent the authentication requirement entirely. As Horizon3.ai explained: “CVE-2026-48710 can be used to bypass the authentication mechanism entirely in LiteLLM deployments whose dependency tree includes Starlette versions <= 1.0.0. This transforms the vulnerability into unauthenticated remote code execution with no credentials required.” This chain, which carries a combined CVSS score of 10.0, was validated by Horizon3.ai on June 1, 2026. It enables attackers to execute arbitrary commands, steal model provider credentials, exfiltrate API keys, and move laterally into connected AI infrastructure.
The threat is significant enough that CISA added CVE-2026-42271 to its Known Exploited Vulnerabilities (KEV) catalog on June 8, 2026, citing active exploitation and setting a federal remediation deadline of June 29, 2026. This marked the first time an agent infrastructure vulnerability reached the KEV list. It was followed by the addition of Langflow CVE-2026-55255 on July 7, 2026. While the technical mechanisms differ—LiteLLM involves command injection via MCP stdio transport, while Langflow involved insecure direct object references—the pattern is consistent. Across the stack, features built for developer convenience are increasingly becoming primary attack vectors.
LiteLLM presents a unique challenge for security teams because it is typically deployed as a transitive Python dependency rather than a standalone service. This means standard vulnerability scanners often overlook it, leaving organizations unaware of their exposure. The history of LiteLLM vulnerabilities, including the rapid exploitation of the SQL injection flaw CVE-2026-42208 within 36 hours of disclosure, suggests that threat actors are actively monitoring this component for weaknesses. With an EPSS score of 80.188%, the likelihood of exploitation is high.
Despite the high risk, there is currently no verified information regarding the identity of the threat actors exploiting CVE-2026-42271, nor is there confirmation that the specific exploit chain involving the Starlette bypass is being leveraged in active attacks. The situation remains fluid, and the lack of visibility into the threat landscape is a significant concern for infrastructure operators.
The broader implication is clear: the rapid integration of new capabilities is outpacing the implementation of robust security controls. Whether it is the command injection risks seen here or the orchestration flaws observed in previous coverage of Langflow, Agent Executor, and Workato, the industry is struggling to reconcile the need for flexible, developer-friendly tools with the realities of production security. As these components become more deeply embedded in enterprise AI stacks, the cost of these design assumptions will only continue to rise.