PT-2026-37185 · Litellm · Litellm

Highjaydns · Published 2026-04-25 · Updated 2026-06-02 · CVE-2026-42271

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LiteLLM versions 1.74.2 through 1.83.6

Description Two endpoints used to preview an MCP server before saving it, "POST /mcp-rest/test/connection" and "POST /mcp-rest/test/tools/list", accepted a full server configuration in the request body. This included the command, args, and env fields used by the stdio transport. When a stdio configuration was provided, the endpoints spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. These endpoints required only a valid proxy API key and lacked role checks, allowing any authenticated user, including those with low-privilege internal-user keys, to execute arbitrary commands on the host.

Recommendations Update to version 1.83.7. As a temporary workaround, block the "POST /mcp-rest/test/connection" and "POST /mcp-rest/test/tools/list" endpoints at the reverse proxy or API gateway.

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2026-42271

ECHO-C4C7-AED2-2231

GHSA-V4P8-MG3P-G94G

Affected Products

Litellm

References · 10

• https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42271 · Security Note
• https://osv.dev/vulnerability/GHSA-v4p8-mg3p-g94g · Vendor Advisory
• https://github.com/BerriAI/litellm · Note
• https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable · Note
• https://t.me/CVEtracker/53071 · Telegram Post
• https://twitter.com/RitikChaddha/status/2061906441901048173 · Twitter Post
• https://i.redd.it/tmd20717pq4h1.png · Reddit Post
• https://twitter.com/CVEnew/status/2053174711496953927 · Twitter Post
• https://twitter.com/infoflowcloud/status/2053175928973316447 · Twitter Post