Assessment
Why it matters
CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 83.0%; technical severity is CVSS 8.7.
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host. This issue has been patched in version 1.83.7.
Who should care
- Teams operating LiteLLM, Litellm, Openshift Ai
- Vulnerability and exposure management teams
- Security operations teams monitoring exploitation activity
Response plan
What I would do
- Confirm whether LiteLLM, Litellm, Openshift Ai is present in the environment.
- Identify affected versions and establish whether vulnerable services are exposed or reachable.
- Red Hat Security advisory CVE-2026-42271
- Review relevant security telemetry for evidence of attempted or successful exploitation.
- Document the remediation decision and track it to verified completion.
Treatment intelligence
Remediation intelligence
Vendor sources are listed before government and third-party guidance. Confirm product applicability and change prerequisites before deployment.
Technical details
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CWE
- CWE-78
- Affected versions
- BerriAI LiteLLM; Litellm Litellm (Start Including 1.74.2, End Excluding 1.83.7); Redhat Openshift Ai (Start Including 2.25, End Excluding 2.25.8 | Start Including 3.3, End Excluding 3.3.4 | Version 3.4)
- Fixed versions
- Litellm Litellm (Fixed from 1.83.7); Redhat Openshift Ai (Fixed from 2.25.8, 3.3.4)
- Published
- 8 May 2026
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
Signal timeline
- CVE published
- Added to CISA KEV
- Latest EPSS score: 83.0%
- Signal calculated at 82