{"id":"CVE-2026-42271","aliases":["GHSA-v4p8-mg3p-g94g","PYSEC-2026-2599"],"url":"https://o3.security/vulnerability/CVE-2026-42271","summary":"LiteLLM: Authenticated command execution via MCP stdio test endpoints","details":"### Impact\n\nTwo endpoints used to preview an MCP server before saving it — `POST /mcp-rest/test/connection` and `POST /mcp-rest/test/tools/list` — accepted a full server configuration in the request body, including the `command`, `args`, and `env` fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process.\n\nThe endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host.\n\n### Patches\n\nFixed in **`1.83.7`**. Both test endpoints now require the `PROXY_ADMIN` role, bringing them into line with the save endpoint.\n\n### Workarounds\n\nIf upgrading is not immediately possible, developers should block `POST /mcp-rest/test/connection` and `POST /mcp-rest/test/tools/list` at their reverse proxy or API gateway.","published":"2026-05-08T03:35:16.758Z","modified":"2026-10-21T02:52:34.735599449Z","cvss":null,"epss":{"score":0.83594,"percentile":0.99668,"asOf":"2026-09-15"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"litellm","fixedVersion":"1.83.7"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42271.json"},{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42271"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27784"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28960"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30056"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-42271"},{"type":"ADVISORY","url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42271.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42271"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467924"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:52:34.735599449Z"}}