CVE-2026-42271
Description
CVE-2026-42271 is a high-severity RCE in LiteLLM (v1.74.2-1.83.6) allowing authenticated users to execute arbitrary commands. Patch to v1.83.7 immediately.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| litellm | 1.74.2 | 1.83.7 | vulnerable |
| openshift_ai | 2.25 | 2.25.8 | vulnerable |
| openshift_ai | 3.3 | 3.3.4 | vulnerable |
| openshift_ai | 3.4 | 3.4 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
Immediately update LiteLLM to version 1.83.7 or later. For users of Red Hat OpenShift AI, apply the specific security patches provided for versions 2.25, 3.3, and 3.4 to mitigate the underlying command injection risk.
Update affected systems
Identify and upgrade all LiteLLM instances running versions 1.74.2 through 1.83.6. Ensure OpenShift AI environments are updated to version 2.25.8, 3.3.4, or 3.4.1 as applicable to remove the vulnerable MCP preview endpoints.
Restrict access
Audit all active proxy API keys and revoke any that are unnecessary. Implement network-level access control lists (ACLs) to restrict access to the LiteLLM management endpoints, specifically limiting POST requests to trusted administrative subnets.
Monitor for exploitation
Review application logs for suspicious POST requests to /mcp-rest/test/connection and /mcp-rest/test/tools/list. Look for request bodies containing 'stdio' transport configurations paired with unexpected shell commands, arguments, or environment variables.
Detection Guidance
"To detect potential exploitation, monitor web application logs for POST traffic directed at the `/mcp-rest/test/connection` and `/mcp-rest/test/tools/list` endpoints. Inspect the JSON payloads for the presence of the 'stdio' transport type combined with shell-sensitive strings in the 'command' or 'args' fields. Additionally, use endpoint detection and response (EDR) solutions to flag any unexpected child processes, such as /bin/sh or cmd.exe, being spawned by the LiteLLM proxy service process."