LiteLLM RCE Vulnerability Exploited in the Wild to Run Commands

Threat actors are actively exploiting a critical unauthenticated remote code execution (RCE) vulnerability in LiteLLM, a widely used open-source AI proxy gateway, by chaining two CVEs to fully bypass authentication and execute arbitrary commands on vulnerable hosts.

Horizon3.ai researchers confirmed the chained exploitation path on June 1, 2026, revealing that CVE-2026-42271, a command injection flaw in LiteLLM’s MCP server test endpoints, can be combined with CVE-2026-48710, a Starlette “BadHost” Host Header validation bypass, to achieve unauthenticated RCE. The combined vulnerability chain carries a CVSS score of 10.0 Critical.

LiteLLM RCE Vulnerability Exploited

CVE-2026-42271 targets two specific LiteLLM MCP server endpoints:

• POST /mcp-rest/test/connection
• POST /mcp-rest/test/tools/list

These endpoints accept a full server configuration, including command, arguments, and environment variables used by the stdio transport, and then spawn the supplied command as a subprocess on the proxy host.

Originally, researchers considered the vulnerability to be of lower severity because access was gated behind a valid proxy API key.

That assumption collapsed when CVE-2026-48710 entered the picture. The “BadHost” flaw affects Starlette versions 1.0.0 and earlier, allowing attackers to manipulate Host header values to sidestep authentication controls entirely.

In LiteLLM deployments whose dependency tree includes a vulnerable Starlette version, no credentials are required to access the command-injection endpoints. The result is a clean, unauthenticated path to full host compromise.

Once exploitation succeeds, attackers gain the ability to execute arbitrary commands as the LiteLLM proxy process. The practical impact extends well beyond the gateway itself:

• Execute arbitrary OS commands on the LiteLLM host
• Access and exfiltrate model provider credentials and API keys
• Steal secrets stored by the proxy
• Move laterally into connected AI infrastructure
• Compromise downstream systems integrated with the gateway

Given that LiteLLM deployments commonly sit at the center of enterprise AI pipelines, routing traffic to OpenAI, Anthropic, Azure OpenAI, and other providers, a successful breach can expose an organization’s entire AI operations layer.

LiteLLM versions 1.74.2 through 1.83.6, combined with Starlette versions 1.0.0 or earlier, are vulnerable to the chained attack. Either condition alone limits exploitability; both together enable unauthenticated RCE, Horizon3 said.

Patch and Mitigation

LiteLLM published a fix in version 1.83.7 on May 8, 2026, introducing additional authorization controls and updating Starlette dependencies. Organizations should also upgrade Starlette to version 1.0.1 or later.

For teams unable to patch immediately, the recommended interim mitigations are:

• Block external access to /mcp-rest/test/connection and /mcp-rest/test/tools/list
• Restrict network access to trusted segments only
• Rotate all credentials and API keys stored by the proxy
• Review logs for unusual Host header values and unexpected subprocess execution events

Organizations running self-hosted LiteLLM instances should treat this as an emergency patch priority given active exploitation in the wild.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.