LiteLLM MCP Test Endpoint Command Execution
- Product
- BerriAI LiteLLM
- CVE
- CVE-2026-42271
- Disclosed
- 2026-04-21
- CVSS
- 8.8
- Auth
- requires auth / interaction
- CISA KEV
- yes
- Affected
- LiteLLM >= 1.74.2, < 1.83.7
- Fixed
- 1.83.7
Summary
LiteLLM, a widely deployed LLM gateway/proxy, let any API-key holder 'preview' an MCP server by supplying the command to launch. The proxy then spawned that command on its own host. CISA added it to KEV in June 2026.
Root cause
POST /mcp-rest/test/connection and /mcp-rest/test/tools/list accepted a full stdio MCP server config (command, args, env) and attempted to connect, which spawned the supplied command as a subprocess. The endpoints only required a valid proxy key with no role check, so low-privilege internal-user keys could run arbitrary commands.
Impact
Remote command execution on the LiteLLM proxy, which typically holds upstream provider API keys for the whole organization.
Detection
Audit requests to /mcp-rest/test/* with stdio transport configs; version check < 1.83.7.
Mitigation
Upgrade to 1.83.7+ (endpoints now require PROXY_ADMIN) and rotate provider keys if exposure is suspected.