BerriAI LiteLLM up to 1.83.6 Endpoint connection command/args/env command injection

Summaryinfo

A vulnerability has been found in BerriAI LiteLLM up to 1.83.6 and classified as critical. This affects an unknown part of the file /mcp-rest/test/connection of the component Endpoint. Performing a manipulation of the argument command/args/env results in command injection. This vulnerability is identified as CVE-2026-42271. The attack can be initiated remotely. Additionally, an exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, was found in BerriAI LiteLLM up to 1.83.6. This affects an unknown part of the file /mcp-rest/test/connection of the component Endpoint. The manipulation of the argument command/args/env with an unknown input leads to a command injection vulnerability. CWE is classifying the issue as CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host. This issue has been patched in version 1.83.7.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-42271 since 04/26/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details and a exploit are known. MITRE ATT&CK project uses the attack technique T1202 for this issue.

It is declared as attacked. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 06/08/2026 with a due date of 06/22/2026:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Upgrading to version 1.83.7 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• BerriAI

Name

• LiteLLM

Version

• 1.83.0
• 1.83.1
• 1.83.2
• 1.83.3
• 1.83.4
• 1.83.5
• 1.83.6

Website

• Product: https://github.com/BerriAI/litellm/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion