External risk intelligence

LiteLLM Command Injection via Unrestricted Configuration

CVE advisoryKnown Exploit

CVE-2026-42271

LiteLLM is designed as an AI gateway or proxy server, which is commonly deployed as an internet-facing service or an edge-accessible API endpoint to facilitate LLM API calls. Its primary role as a centralized gateway for AI services makes it highly probable to be exposed to network traffic from external or internet-connected environments.

OS Command Injection

Litellm

1.74.2 to before 1.83.72.25 to before 2.25.83.3 to before 3.3.43.4

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the LiteLLM AI Gateway could allow authenticated users to execute arbitrary commands on the host system. This is due to how certain endpoints handled server configurations, potentially leading to unauthorized command execution with the privileges of the proxy process. The issue has been patched in version 1.83.7.

Any authenticated user can run commands.
It affects a central AI gateway service.
Confirm if your AI gateway is exposed.

Attack Path

How an attacker could exploit the issue

An attacker with a valid API key can send a crafted request to specific LiteLLM endpoints. These endpoints process server configurations, and if a malicious command is included in the configuration, LiteLLM will execute it as a subprocess on the host. This allows an attacker to run arbitrary commands with the privileges of the LiteLLM process.

Requires authenticated access.
Triggered by sending a malicious server configuration.
Leads to arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

An authenticated user could execute arbitrary commands on the LiteLLM proxy server host. This could occur when the server attempts to test an MCP server configuration, if the affected endpoints are called with a stdio configuration and a malicious command.

Arbitrary command execution on host.
Endpoints accept and run commands.
Compromise of the proxy host system.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for managing API gateways, AI infrastructure, or application platforms should prioritize this vulnerability. The immediate practical step is to identify all instances of the affected LiteLLM proxy, confirm its accessibility from the network, and determine its business criticality to prioritize remediation efforts.

Identify and inventory affected systems.
Verify network exposure and impact.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is LiteLLM and why is it used?

LiteLLM is a proxy server, often called an AI Gateway, designed to translate various LLM API requests into a unified format. It acts as a central hub for applications to interact with multiple AI models, streamlining authentication and routing for developers who need to manage AI API calls efficiently within their infrastructure.

How does CVE-2026-42271 lead to command injection?

This vulnerability falls under the CWE-77 and CWE-78 weakness classes, which involve improper neutralization of special elements used in commands. In LiteLLM, specific endpoints designed to preview configurations would accept server settings and unintentionally execute them as subprocesses on the host. This effectively allowed a user-supplied string to be treated as a system command.

What triggers the vulnerability in LiteLLM?

The flaw is triggered when an authenticated user sends a request to specific MCP preview endpoints containing a malicious stdio server configuration. The bug is not triggered by standard AI API traffic or by users lacking a valid proxy API key. The system only executes the code when it attempts to validate or test the connection using the attacker-supplied configuration details.

Is my deployment at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a high-priority concern because LiteLLM is typically deployed as an internet-facing gateway or an edge service. Because these services are often positioned to handle external network traffic, any internal or external user holding a valid API key has the potential to reach these vulnerable endpoints and gain unauthorized control over the proxy host.

Do I need to update my LiteLLM instance?

Yes. The first step is to inventory your environment to locate all running instances of LiteLLM version 1.74.2 through 1.83.6. Once identified, you should prioritize upgrading these instances to version 1.83.7, which contains the necessary patches to disable the vulnerable endpoint logic and prevent arbitrary command execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.