Critical Alert: CVE-2026-42271 exposes remote code execution in LiteLLM and the Starlette attack chain

The US Agency for Infrastructure and Cybersecurity. United States. ( CISA KEV) has recently included high severity vulnerability CVE-2026-42271 in its "Known Exploited Vulnerabilities" catalogue, indicating evidence of active exploitation. This is a command injection into BerriAI's LiteLLM package that allows any authenticated user to run arbitrary commands in the host where the proxy runs, taking advantage of two test endpoints that accepted a complete server configuration, including fields such as command, args and env when using the stdio transport.

In technical terms, the problem arises because the endpoints POST / mcp-rest / test / connection and POST / mcp-rest / test / tools / list tried to establish the connection by invoking a subprocess with the values provided by the client, which means that a request with a malicious order could be executed with the privileges of the proxy process. Although the endpoints were initially protected by a key API, this protection proved insufficient: a valid proxy key, even from an internal user with privileges, was sufficient to exploit the failure.

Gravity increased when Horizon3.ai researchers showed how to chain CVE-2026-42271 with CVE-2026-48710, a failure to validate the header Host in Starlette that allows to omit authentication ("BadHost"). According to this analysis, deploying LiteLLM with Starlette units ≤ 1.0.0 transforms vulnerability into remote code execution without the need for credentials, making the vector particularly dangerous for exposed infrastructure. The public description of Starlette is available in its repository to understand the scope of the component concerned: https: / / github.com / encode / starlette.

The potential impact of successful exploitation goes beyond running commands: an attacker could steal credentials from model providers, exfiltered API keys and secrets kept by the proxy, pivoting laterally to other components of IA infrastructure and compromising integrated systems downstream. Horizon3.ai points out that, together, the chain can deserve a critical score, and CISA has already marked vulnerability as exploited in real environments. For standard details and CVE monitoring, the NVD database maintains public fact sheets that are useful as a reference: CVE-2026-42271 and CVE-2026-48710.

LiteLLM's maintainers published a correction in version 1.83.7 that tightens the permissions of the test endpoints, demanding the role PROXY _ ADMIN - the same requirement that the saved endpoint already had - and thus reduces the risk window for users who should not have that level of control. At the same time, security teams recommend updating Starlette to version 1.0.1 or later if it is part of the chain of units of their deployment.

If you cannot park immediately, there are provisional measures that reduce the attack surface: block at the proxy or gateway level the POST / mcp-rest / test / connection and POST / mcp-rest / test / tools / list, limit network access to confidence segments, rotate all the credentials stored by the proxy and audit logs looking for unusual header Host patterns or subprocess creation activity. These actions do not replace the parking, but compress the operating window while planning the update.

For response and operation teams it is critical to review process telemetry and endpoint controllers in search of unexpected command executions, outgoing connection to endpoints of model suppliers, and unauthorized changes in proxy configuration files. It is also appropriate to treat proxy keys and supplier credentials as high-sensitivity secrets: to rotate them immediately, to force revocation and to apply stricter access controls and role-separation policies (least privilege) in systems that manage IA gateways.

This incident highlights a broader trend: infrastructure parts that facilitate the use of IA models - gateways, SDKs and proxies - have become attractive targets because they concentrate credentials and access to critical systems. The recurrence of operating failures in very short windows (for example, an SQL injection in LiteLLM that was exploited in less than 36 hours after its disclosure) shows that operators actively monitor repositories and releases, and that organizations should adopt agile update and early detection models.

Finally, in addition to updating to LiteLLM ≥ 1,83.7 and a Starlette ≥ 1.0.1 it is recommended to incorporate software composition analysis (SCA) into the CI / CD pipelines to detect vulnerable dependencies, segregate administrative functions into specific roles, use encryption and automatic rotation of secrets, and regularly test the organization's detection capacity with CSR-oriented exercises in components of the IA chain. The combination of patches, temporary mitigation and operational strengthening is the only practical way to reduce the risk to threats that are currently looking for chains such as that described by Horizon3.ai: https: / / www.horizon3.ai.