Executive Summary

CVE-2026-42271 is a high-severity vulnerability in the LiteLLM proxy server versions 1.74.2 to before 1.83.7. Two endpoints used for previewing an MCP server accepted a full server configuration including command, args, and env fields. When these endpoints were called with a stdio configuration, they spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process.

These endpoints were only protected by a valid proxy API key and did not perform any role checks, meaning any authenticated user, even those with low-privilege internal-user keys, could execute arbitrary commands on the host system.

This vulnerability was patched in version 1.83.7 by requiring the PROXY_ADMIN role for these endpoints.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows any authenticated user with a valid proxy API key, including low-privilege users, to execute arbitrary commands on the host system. This unauthorized command execution can lead to unauthorized access, data breaches, or manipulation of sensitive information.

Such unauthorized access and potential data compromise can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strict controls over access to sensitive data and systems, as well as measures to prevent unauthorized actions.

Because the vulnerability permits privilege escalation and arbitrary command execution without proper role checks, it increases the risk of violating data protection and security requirements mandated by these regulations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows any authenticated user with a valid proxy API key to execute arbitrary commands on the host system running the LiteLLM proxy server.

Such arbitrary command execution can lead to unauthorized access, data compromise, system disruption, or full control over the proxy host, depending on the privileges of the proxy process.

Because low-privilege users can exploit this, it significantly increases the risk of insider threats or compromised credentials being used to escalate attacks.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for requests to the two vulnerable endpoints: POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list.

You can look for API calls that include a full server configuration in the request body, especially those containing command, args, and env fields that might be used to spawn subprocesses.

To detect exploitation attempts, you can search your web server or proxy logs for POST requests to these endpoints with suspicious payloads.

• Use tools like curl or wget to simulate requests and verify if the endpoints are accessible without proper role checks.
• Example command to check access (replace <host> and <api_key>):
• curl -X POST https://<host>/mcp-rest/test/connection -H "Authorization: Bearer <api_key>" -d '{"command":"id"}'
• Check logs for unexpected command execution or subprocess spawning related to these endpoints.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade LiteLLM to version 1.83.7 or later, where the vulnerability is patched.

If immediate upgrade is not possible, block access to the vulnerable endpoints POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list at the reverse proxy or API gateway.

Ensure that only users with the PROXY_ADMIN role can access these endpoints after upgrading.

Useful 0 Not Useful 0