LiteLLM Proxy Server MCP Test Endpoints Remote Code Execution Vulnerability Advisory (CVE-2026-42271)

1. Official Patch Application (Recommended)

Upgrade your LiteLLM deployment to version 1.83.7 or later.

# For pip-based installations
pip install --upgrade litellm>=1.83.7

# For Docker-based deployments, update your image tag in Dockerfile or docker-compose.yml
# image: ghcr.io/berriai/litellm:v1.83.7

2. Temporary Mitigation (If patching is delayed)

If an immediate upgrade is not feasible, block all external traffic to the vulnerable endpoints using a reverse proxy (e.g., Nginx) or a Web Application Firewall (WAF).

Nginx Configuration Example:

# Block access to vulnerable MCP test endpoints
location ~* ^/mcp-rest/test/(connection|tools/list) {
    deny all;
    return 403;
}

WAF Rule Configuration:

• Target URIs: /mcp-rest/test/connection, /mcp-rest/test/tools/list
• HTTP Method: POST

LiteLLM is an open-source proxy server (AI Gateway) designed to streamline LLM API calls. A critical vulnerability (CVE-2026-42271) exists in two endpoints used to preview Model Context Protocol (MCP) servers before saving them: POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list.

These endpoints accept a full server configuration within the request body, including the command, args, and env fields utilized by the stdio transport mechanism. When invoked, the application attempts to establish a connection by spawning the supplied command as a subprocess on the host machine under the privileges of the active proxy process.

Because these endpoints only require a valid proxy API key and lack proper role-based access control (RBAC) checks, any authenticated user—including those holding low-privilege internal-user keys—can exploit this behavior to achieve Remote Code Execution (RCE). Given its high EPSS score (0.94) and KEV status, this vulnerability poses an immediate threat to deployments.