Critical LiteLLM Vulnerabilities Expose AI Gateways to Unauthenticated RCE
In May 2026, a critical vulnerability chain was discovered in LiteLLM, an open-source AI gateway widely used to interface with over 100 large language model providers. The primary flaw, CVE-2026-42271, is a command injection vulnerability affecting versions 1.74.2 through 1.83.6. This vulnerability allows authenticated users, including those with low-privilege internal-user keys, to execute arbitrary commands on the host system by exploiting two Model Context Protocol (MCP) test endpoints. When combined with CVE-2026-48710, an authentication bypass in the Starlette web framework, attackers can achieve unauthenticated remote code execution, granting them full control over the server. This chain of vulnerabilities exposes sensitive API keys and secrets stored by the proxy, potentially compromising connected AI systems and enabling lateral movement within enterprise networks. The active exploitation of these vulnerabilities underscores the increasing targeting of AI gateway infrastructures by threat actors. Organizations relying on LiteLLM are urged to upgrade to version 1.83.7 or later, which addresses these issues by implementing stricter authorization controls and updating dependencies. Additionally, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-42271 to its Known Exploited Vulnerabilities catalog, emphasizing the urgency for immediate remediation to prevent potential breaches and data exfiltration.
Kill Chain
