BerriAI · LiteLLM
LiteLLM (by BerriAI) has a flaw in its MCP server preview endpoints, POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list, which accept a full stdio server configuration including command, args, and env fields. An authenticated attacker with any valid proxy API key, including low-privilege internal-user keys, can have the supplied command spawned as a subprocess on the proxy host with the proxy process's privileges, requiring only network access to the proxy and no user interaction or special configuration.
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host. This issue has been patched in version 1.83.7.
First seen exploited 31 days after disclosure. Public exploit code (Metasploit) was available 17 days before disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Exploited via exposed HTTP API endpoints
POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list
Arbitrary command execution on proxy host
the endpoints attempted to connect, which spawned the supplied command as a subprocess
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: litellm.
Upgrade to 1.84.0 or later
Fixes this CVE and 5 other known vulnerabilities in this package (CVE-2026-35029, CVE-2026-40217, +3).
pip install "litellm>=1.84.0"First fixed in 1.83.7 for CVE-2026-42271.
| If you run | Upgrade to |
|---|---|
| 1.74.2 up to 1.83.7 | 1.84.0first fix for this CVE: 1.83.7 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.