VulnRadar

Data against noise.

Built with NaN
Page generated: 08 Nov 2026, 14:29 UTC
← Dashboard

CVE-2026-42271

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full s…

Read full description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host. This issue has been patched in version 1.83.7.
CVSS 8.8 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
0.0/10
REALITY · THREAT PRIORITY
8.8/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 8.8: +1.32
  • Fresh EPSS: 91.44%: +0.46

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 11 documents and public datasets.

Hype components

Headline sample (25%)
0/100
Press, 30 days (60%)
0/100
Grounded branding (15%)
0/100
HYPE TOTAL0/100

Sources and documents

Threat Intelligence
Press · 30 Sep 2026, 14:00 · Vulnerability Discovery and Exploitation Trends in the AI Era
The Hacker News
Press · 03 Sep 2026, 07:00 · CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners - The Hacker News
CyberSecurityNews
Press · 28 Aug 2026, 07:00 · Hackers Target AI Infrastructure With RCE, Prompt Injection and API Key Theft - CyberSecurityNews
Microsoft
Press · 26 Aug 2026, 07:00 · When AI infrastructure becomes the target: Securing gateways and control points - Microsoft
Rescana
Press · 16 Jun 2026, 07:00 · Critical LiteLLM Vulnerability Chain Enables Remote Code Execution and Full AI Gateway Server Takeover (CVE-2026-42271, CVE-2026-47101, CVE-2026-47102, CVE-2026-40217) - Rescana
See all 11 source documents
CyberSecurityNews
Press · 09 Jun 2026, 07:00 · Hackers Exploiting LiteLLM RCE Vulnerability in the Wild to Run Arbitrary Commands - CyberSecurityNews
Cyber Press
Press · 09 Jun 2026, 07:00 · LiteLLM RCE Vulnerability Exploited in the Wild to Run Commands - Cyber Press
Help Net Security
Press · 09 Jun 2026, 07:00 · LiteLLM vulnerability under active attack, CISA warns (CVE-2026-42271) - Help Net Security
GBHackers News
Press · 09 Jun 2026, 07:00 · LiteLLM Vulnerability Allows Attackers to Execute Arbitrary Commands on Servers - GBHackers News
Rescana
Press · 09 Jun 2026, 07:00 · Active Exploitation Alert: CVE-2026-42271 and CVE-2026-48710—Unauthenticated RCE in LiteLLM AI Gateway via Starlette Host Header Bypass - Rescana
The Hacker News
Press · 09 Jun 2026, 07:00 · LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE - The Hacker News

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.8 (2026-11-02 15:14). The curve appears once the score changes.

Public exploit evidence

1

Public exploit entries / repo candidates

See 1 repos with metrics
RepositoryStarsForksLanguageUpdated
learner202649/CVE-2026-42271-PoC10Python20 May 2026, 01:13
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 8.8; EPSS 91.4%
Attention, last 30 days
0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential
network access, low privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 14:00:10.041099+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
Published
08 May 2026, 03:35
Added to the CISA KEV catalog
08 Jun 2026, 00:00
First press mention
09 Jun 2026, 07:00
Latest press mention
30 Sep 2026, 14:00
Score calculated
05 Nov 2026, 14:00
PoCs on GitHub
1 repositories
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar