CISA has added an actively exploited LiteLLM vulnerability to its KEV catalogue after researchers showed it can be chained with a Starlette flaw to achieve unauthenticated remote code execution, putting AI credentials and infrastructure at risk.
A high-severity vulnerability in LiteLLM, an open-source AI gateway and Python SDK, has been added to the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalogue following evidence of active exploitation in the wild.
Tracked as CVE-2026-42271, the command injection flaw carries a CVSS score of 8.7 and allows authenticated users to execute arbitrary commands on affected hosts. However, researchers at Horizon3.ai found the issue can be chained with CVE-2026-48710, a Starlette “BadHost” host header validation bypass vulnerability, escalating the risk significantly.
“CVE-2026-48710 can be used to bypass the authentication mechanism entirely in LiteLLM deployments whose dependency tree includes Starlette versions ≤ 1.0.0,” Horizon3.ai researchers said. “This transforms the vulnerability into unauthenticated remote code execution with no credentials required.”
The vulnerability affects LiteLLM versions 1.74.2 through 1.83.6. According to BerriAI, maintainers of LiteLLM, two MCP preview endpoints accepted full server configurations, including command, args and env fields, allowing supplied commands to be spawned as subprocesses on the proxy host.
Successful exploitation could enable attackers to execute arbitrary commands, access model provider credentials, steal API keys and secrets, move laterally across connected AI environments, and compromise downstream systems.
BerriAI addressed the issue in LiteLLM 1.83.7 by restricting the affected endpoints to users with the PROXY_ADMIN role. Users are advised to upgrade LiteLLM to version 1.83.7 or later and Starlette to version 1.0.1 or later.
