CVE-2026-42271: LiteLLM command execution through MCP test endpoints

Summary

LiteLLM versions from 1.74.2 up to, but not including, 1.83.7 expose two endpoints, POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list, that accept a full MCP server configuration including the stdio transport's command, args and env fields. Any holder of a valid proxy API key, including low-privilege internal-user keys, can make these endpoints spawn an arbitrary command as a subprocess on the proxy host with the proxy process's privileges, because no role check gates them.

Mitigation

Fixed in 1.83.7.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• litellmPyPILLM dependency since 2023-07-27 · 55 tracked dependents

Topics

• Model Context Protocol

Related items

• HighCVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name NormalizationSimilar attack · AWS Security Bulletins
• HighGHSA-ghwv-vrp2-2975: Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU AttacksSimilar attack · GitHub Advisory Database
• MediumGHSA-5m6c-38r8-5w76: Dagu MCP DAG specification read bypasses path containment and workspace isolationSimilar attack · GitHub Advisory Database
• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database