Skip to content
Now taking design partners.Roadmap →
Sekeye

pypi · 2026

LiteLLM MCP RCE

Command injection in LiteLLM's MCP test endpoints (CVE-2026-42271, CVSS 8.7). On CISA KEV since 8 June 2026, exploited in the wild, and chainable to unauthenticated RCE. A successful call exposes every model-provider key the proxy holds.

Run this campaignScale: Every provider key behind the proxyBrief updated

What happened

LiteLLM is a Python proxy that fronts many model providers behind a single endpoint. Teams put it in front of Claude, OpenAI, Bedrock, and self-hosted models so that applications hold one key instead of many. That consolidation is exactly what makes it worth attacking.

CVE-2026-42271 is a command-injection flaw reachable through the proxy's MCP endpoints. Input that should have been treated as tool arguments reached a shell context instead. The vulnerability was added to the CISA Known Exploited Vulnerabilities catalog on 8 June 2026 after exploitation was confirmed in the wild.

The blast radius is the point. A proxy exists to hold credentials. Code execution on the proxy host reaches every provider key configured on it, plus whatever else lives in that process environment, and the proxy usually runs on a server, not a laptop.

Why this surface is different

A model proxy is rarely in an asset inventory as a security-relevant system. It gets deployed by an application team, holds production credentials, and is patched on the application team's schedule. It is infrastructure with the risk profile of a secrets store and the change management of a side project.

What a Sekeye campaign does

The LiteLLM template sweeps for the proxy as an installed artefact, not as a network service:

  1. Agents report pypi and container-image inventory across laptops and servers, including LiteLLM version.
  2. Version-range matching flags hosts inside the affected range, with the KEV and EPSS signals attached so the finding lands in the P0 band rather than a generic CVE queue.
  3. The blast-radius view lists the credential names present in the proxy's environment, never the values, so the rotation scope is known before the incident call starts.

Rotation guidance

Treat every model-provider key configured on an affected host as disclosed. Rotate provider API keys, then any cloud role the proxy assumed, then the service account that deployed it. Provider keys are often shared across environments, check staging and CI as well as production.

Confirmed against public reporting

CVE-2026-42271 is a command-injection flaw (CVSS 8.7) in LiteLLM's MCP test endpoints, POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list, which accepted a full stdio server config including command, args, and env with no allowlist or admin gate. Affected versions run 1.74.2 through 1.83.6; the fix landed in 1.83.7 on 8 May 2026.

Horizon3.ai showed it chains with CVE-2026-48710, a Starlette Host-header auth bypass known as BadHost, for unauthenticated RCE at CVSS 10.0. CISA added it to the Known Exploited Vulnerabilities catalog on 8 June 2026 after confirming exploitation in the wild.

Sources