LiteLLM MCP Command Injection: CVE-2026-42271

GTIG confirms CVE-2026-42271 exploitation: valid LiteLLM keys could run commands via MCP previews. Upgrade to 1.83.7 or later.^{[1], [6], [8]}

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N^[1]

💡 Plain English Explainer (ELI5)

A workshop lets visitors preview a tool before adding it. The preview desk can start a powerful workshop machine, so only a supervisor should hand it instructions. In vulnerable LiteLLM versions, any accepted badge could reach that desk. A separate Starlette flaw could also fool a guard that decides access from a reconstructed URL; each boundary needs its own fix. At a second desk, a visitor can write a slash or question mark on the outside of a parcel. The clerk pastes that text into a rebuilt address and mistakes it for a new route, even though the parcel still travels down the original hallway. That is the separate Host-to-path confusion in Starlette.^{[1], [3], [5]}

Core Concepts & Subsystem Terms

Model Context Protocol (MCP): A protocol through which an application such as an AI gateway connects to external tools and data sources. LiteLLM's preview endpoints let an operator test a proposed MCP server configuration before saving it.^[1]
stdio transport: An MCP connection mode that starts a local child process and exchanges messages over standard input and output. The process runs on the LiteLLM proxy host with the proxy process's operating-system privileges.^{[1], [2]}
Role-based authorization: A server-side check that grants an operation only to an identity with the required role. CVE-2026-42271 left the preview routes without the PROXY_ADMIN check used by the save operation.^{[1], [2]}
CVE-2026-48710 (Starlette BadHost): A separate Starlette flaw where an invalid Host header could make request.url.path differ from the path used by routing. Horizon3 reported that this could bypass LiteLLM path-based authentication in affected dependency combinations; it is not part of CVE-2026-42271 itself.^{[3], [5], [4]}
MCP stdio command allowlist: A set of executable basenames LiteLLM accepts for stdio transport. It is checked during configuration validation and again before client creation for legacy records. It is not a sandbox because allowed runtimes may interpret supplied arguments.^[8]

Framework mappings

CWE reference for the weakness described in this guide: CWE-78
CISA KEV — added 2026-06-08 — CVE-2026-42271

Step-by-Step Attack Flow

Step 1

Confirm the LiteLLM version and endpoint exposure

The maintainer advisory affects LiteLLM >=1.74.2 and <1.83.7 and requires a valid proxy API key; before the patch, any authenticated key holder, including a low-privilege internal-user key, could reach the preview routes. GTIG includes CVE-2026-42271 in its confirmed-exploitation list, but for this CVE's prerequisite use the maintainer advisory's authenticated threat model.^{[1], [6]}

Step 2

A lower-privilege key reaches an administrative preview action

The endpoints accepted a complete MCP server configuration, including stdio command, arguments, and environment fields. The server authenticated a key but did not check that its role was PROXY_ADMIN, so any authenticated key holder could invoke the preview operation.^[1]

Step 3

Preview starts a process on the proxy host

To test the supplied stdio configuration, LiteLLM created an MCP client and spawned the configured child process with the proxy service's privileges. This is command execution on the gateway host, not merely an AI model returning unsafe text.^{[2], [8]}

Step 4

A separate Starlette flaw can weaken the authentication boundary

Horizon3 reported that CVE-2026-48710 could make path-based authentication see a different request.url.path from the route selected by Starlette when an affected Starlette release was present. Its researchers reported chaining that behavior with CVE-2026-42271 to remove the API-key prerequisite in affected deployments. Treat this as the researchers' validated chain; the two CVEs have separate root causes and patches.^{[5], [3], [4]}

Step 5

Patch both boundaries and verify resolved packages

LiteLLM fixed the preview routes in 1.83.7: they now require PROXY_ADMIN and tools/list has explicit authentication. The patch also validates the command allowlist on new/update requests and again inside _create_mcp_client to catch legacy configuration. The allowlist is not a sandbox; allowed runtimes can still interpret arguments. Starlette separately fixed CVE-2026-48710 in 1.0.1; verify the resolved package combination and assess the reported chain independently.^{[1], [8], [4], [7]}

Step 6

Recent campaign context (reported October 7, 2026)

Black Lotus Labs reported that a PoeLLM malware sample likely targeted /mcp-rest/test/connection; BleepingComputer also reported attempts to exploit CVE-2026-42271 in the campaign. The report does not establish that every infected host was compromised through this CVE, or that every LiteLLM target was vulnerable. Treat this as evidence of current targeting, not a victim count attributable to this flaw.^{[9], [10]}

Root Cause Analysis

The LiteLLM flaw was a missing role check on both MCP preview routes: any valid proxy API key could invoke them without the PROXY_ADMIN role. The connection preview accepted a caller-supplied stdio configuration and spawned its command under the proxy process's privileges. A separate Starlette flaw let a malformed Host header make request.url.path differ from the path Starlette routed; Horizon3 reported that path-based API-key validation could be bypassed when this behavior was chained with LiteLLM. These are distinct vulnerabilities: fix the LiteLLM authorization and command-execution boundaries, and update Starlette to 1.0.1 or later.^{[1], [8], [3], [4], [5]}

Source Code: Flaw vs. Secure Implementation

This excerpt follows the merged LiteLLM patch at the execution boundary: it checks the command basename before constructing the stdio client, so legacy database/config records also pass through the guard. The patch additionally validates new and updated server requests and restricts both preview routes to PROXY_ADMIN; /test/tools/list also gained an explicit user_api_key_auth dependency. The allowlist is not a sandbox: allowed runtimes can still interpret their arguments, so keep preview access admin-only and run the proxy with least privilege.^{[1], [2], [8]}

Source excerpt: LiteLLM source excerpt: litellm/proxy/_experimental/mcp_server/mcp_server_manager.py — _create_mcp_client

UNPATCHED FLAW

# _create_mcp_client before the stdio command guard was added.
if server.command and server.args is not None:
    stdio_config = MCPStdioConfig(
        command=server.command,
        args=server.args,
        env=resolved_env,
    )

HARDENED SECURE PATCH

# _create_mcp_client: repeat validation for legacy DB/config records.
if server.command:
    base_command = os.path.basename(server.command)
    if base_command not in MCP_STDIO_ALLOWED_COMMANDS:
        raise HTTPException(
            status_code=403,
            detail="MCP stdio command is not in the allowlist",
        )

if server.command and server.args is not None:
    stdio_config = MCPStdioConfig(
        command=server.command,
        args=server.args,
        env=resolved_env,
    )

Engineering & System Hardening Checklist

✓Inventory LiteLLM proxy deployments and confirm each resolved package version; upgrade affected releases to 1.83.7 or later.^{[1], [8]}
✓Inspect the deployed dependency lockfile or container image and confirm Starlette is 1.0.1 or later when the resolved FastAPI version supports it; do not apply an untested dependency override.^{[3], [7]}
✓Until LiteLLM can be upgraded, block POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list at the reverse proxy or API gateway, as the maintainer advisory recommends.^[1]
✓Verify both preview routes require user_api_key_auth and reject every role except PROXY_ADMIN before creating an MCP client.^{[1], [8]}
✓Add tests proving that an unauthenticated request and a valid non-admin key cannot reach either preview operation, while an authorized admin can use the supported preview workflow.^[8]
✓For the Starlette boundary, test malformed Host handling and ensure access-control middleware uses the canonical ASGI path or a framework-validated request URL.^{[3], [4]}
✓Review proxy access logs and child-process telemetry for unexpected use of the MCP preview routes; rotate proxy-held credentials if investigation finds plausible host access.^{[1], [8]}
✓Keep the two vulnerability records distinct in tickets and incident notes: CVE-2026-42271 is LiteLLM command execution; CVE-2026-48710 is Starlette Host parsing and path confusion.^{[1], [3]}
✓Review LITELLM_MCP_STDIO_EXTRA_COMMANDS in every environment; custom entries expand the executable trust boundary and do not make argument handling safe.^[8]

Sources

← AI Security Hub Directory →