CVE-2026-42271

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host. This issue has been patched in version 1.83.7.

Database specific

{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42271.json",
    "cwe_ids": [
        "CWE-77",
        "CWE-78"
    ]
}

References

Affected packages

Git / github.com/berriai/litellm

Affected ranges

Type

GIT

Repo

https://github.com/berriai/litellm

Events

Introduced

225e9f3d552d190a3042f1081bcc17e6f599d151

Fixed

e0d5c28db02b3219dbd944666a55f49732197922

Database specific

{
    "cpe": "cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.74.2"
        },
        {
            "fixed": "1.83.7"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.74.15.rc.1

litellm-pres-dev-v1.*

litellm-pres-dev-v1.81.15

litellm_1.*

litellm_1.81.13-dev

litellm_pro-mgmnt-dev-v1.*

litellm_pro-mgmnt-dev-v1.81.13

litellm_sso-dev-v1.*

litellm_sso-dev-v1.81.13

litellmv1.*

litellmv1.81.15.presidio.dev

v1.*

v1.74.12-nightly

v1.74.14-nightly

v1.74.15-nightly

v1.74.2-nightly

v1.74.3-nightly

v1.74.3-stable-draft

v1.74.3.rc.1

v1.74.4-nightly

v1.74.5.dev1

v1.74.6-nightly

v1.74.7-nightly

v1.74.7.rc.1

v1.74.8-nightly

v1.74.9-stable

v1.74.9.rc-draft

v1.74.9.rc.1

v1.75.0-nightly

v1.75.2-nightly

v1.75.3-nightly

v1.75.4-nightly

v1.75.5-stable.rc-draft

v1.75.5.rc.1

v1.75.6-nightly

v1.75.7-nightly

v1.75.8-nightly

v1.75.8-stable

v1.75.9-nightly

v1.76.0-nightly

v1.76.0-stable-draft

v1.76.1-nightly

v1.76.1.rc.1

v1.76.2-nightly

v1.76.3-nightly

v1.76.3.dev1

v1.76.3.rc.1

v1.77.0-nightly

v1.77.1-nightly

v1.77.1.dev.1

v1.77.1.dev.2

v1.77.1.rc.1-v2

v1.77.2.rc.1

v1.77.3-nightly

v1.77.3.dynamic_rates

v1.77.4-nightly

v1.77.5-nightly

v1.77.5.rc.1

v1.77.6.dev.1

v1.77.7-nightly

v1.77.7.dev.3

v1.77.7.dev9

v1.77.7.rc.1

v1.77.7.rc.2

v1.78.0-nightly

v1.78.2-nightly

v1.78.3-nightly

v1.78.4-nightly

v1.78.4.dev1

v1.78.5-nightly

v1.78.5-stable

v1.78.5.rc.1

v1.78.6-nightly

v1.78.7-nightly

v1.79.0-nightly

v1.79.0.rc.1

v1.79.1-nightly

v1.79.1.rc.1

v1.79.2-nightly

v1.79.3-nightly

v1.79.3.dev5

v1.79.3.dev7

v1.79.3.rc.1

v1.79.dev.1

v1.80.0-nightly

v1.80.0.dev1

v1.80.0.dev2

v1.80.0.dev6

v1.80.10-nightly

v1.80.10.dev.1

v1.80.10.rc.1

v1.80.11-nightly

v1.80.11-stable

v1.80.11.rc.1

v1.80.12-nightly

v1.80.13-nightly

v1.80.15-nightly

v1.80.15.rc.1

v1.80.16-nightly

v1.80.16.dev6

v1.80.17-nightly

v1.80.5-nightly

v1.80.5.dev2

v1.80.6-nightly

v1.80.7.dev.3

v1.80.8-nightly

v1.80.8.dev.1

v1.80.8.rc.1

v1.80.9-nightly

v1.80.9.dev1

v1.81.0-nightly

v1.81.0.rc.1

v1.81.1-nightly

v1.81.12-nightly

v1.81.13.dev1

v1.81.14-nightly

v1.81.14.rc.1

v1.81.16.custm-auth.dev

v1.81.3-nightly

v1.81.3.rc

v1.81.3.rc.1

v1.81.3.rc.5

v1.81.7.dev1

v1.81.9-nightly

v1.81.9-stable

v1.81.9.rc.1

v1.82.1-nightly

v1.82.1-silent-dev2

v1.82.1.rc.1

v1.82.4-nightly

v1.82.5.dev.1

v1.82.6.dev2

v1.83.0-nightly

v1.83.1-nightly

v1.83.2-nightly

v1.83.3-stable

v1.83.3.rc.1

v1.83.5-nightly

v1.83.6-nightly

v1.83.7.rc.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42271.json"