GHSA-v4p8-mg3p-g94g

Suggest an improvement
Source
https://github.com/advisories/GHSA-v4p8-mg3p-g94g
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-v4p8-mg3p-g94g/GHSA-v4p8-mg3p-g94g.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-v4p8-mg3p-g94g
Aliases
  • CVE-2026-42271
Downstream
Related
Published
2026-04-25T23:27:54Z
Modified
2026-06-09T13:15:14.439320033Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N CVSS Calculator
Summary
LiteLLM: Authenticated command execution via MCP stdio test endpoints
Details

Impact

Two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process.

The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host.

Patches

Fixed in 1.83.7. Both test endpoints now require the PROXY_ADMIN role, bringing them into line with the save endpoint.

Workarounds

If upgrading is not immediately possible, developers should block POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list at their reverse proxy or API gateway.

Database specific 
{
    "nvd_published_at": "2026-05-08T04:16:21Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-25T23:27:54Z",
    "cwe_ids": [
        "CWE-77",
        "CWE-78"
    ]
}
References

Affected packages

PyPI / litellm

Package

Name
litellm
View open source insights on deps.dev
Purl
pkg:pypi/litellm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.74.2
Fixed
1.83.7

Affected versions

1.*
1.74.2
1.74.3rc1
1.74.3rc2
1.74.3rc3
1.74.3
1.74.3.post1
1.74.4.dev1
1.74.4
1.74.6
1.74.7rc1
1.74.7
1.74.7.post1
1.74.7.post2
1.74.8.dev2
1.74.8
1.74.9.dev1
1.74.9.dev2
1.74.9
1.74.9.post1
1.74.9.post2
1.74.12
1.74.14
1.74.15
1.74.15.post1
1.74.15.post2
1.75.0
1.75.2
1.75.3
1.75.4
1.75.5.post1
1.75.5.post2
1.75.6
1.75.7
1.75.8
1.75.9
1.76.0
1.76.1
1.76.2
1.76.3
1.77.0
1.77.1
1.77.2.post1
1.77.3
1.77.4.dev1
1.77.4
1.77.5
1.77.7
1.78.0rc2
1.78.0
1.78.2
1.78.3
1.78.4
1.78.5
1.78.6
1.78.7
1.79.0.dev1
1.79.0.dev2
1.79.0.dev3
1.79.0
1.79.1
1.79.2
1.79.3.dev8
1.79.3
1.80.0
1.80.5
1.80.6
1.80.7
1.80.8
1.80.9
1.80.10
1.80.11
1.80.12
1.80.13
1.80.15
1.80.16
1.80.17
1.81.0
1.81.1
1.81.3
1.81.4
1.81.5
1.81.6
1.81.7
1.81.8
1.81.9.dev1
1.81.9
1.81.10
1.81.11
1.81.12
1.81.13
1.81.14
1.81.15
1.81.16
1.82.0
1.82.1
1.82.2
1.82.3
1.82.4
1.82.5
1.82.6
1.83.0
1.83.1
1.83.2
1.83.3
1.83.4
1.83.5
1.83.6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-v4p8-mg3p-g94g/GHSA-v4p8-mg3p-g94g.json"