← Back to feed
2026-07-26 Mcp SecurityMalicious ToolPrompt Injection TLP:CLEAR

LiteLLM AI Gateway CVE-2026-42271: Command Injection in MCP Integration Enables Unauthenticated RCE (June 2026)

Date: 2026-07-26
Tags: mcp-security, malicious-tool, prompt-injection

Executive Summary

CVE-2026-42271 is a high-severity command injection vulnerability (CVSS 8.7) in LiteLLM, a widely deployed open-source AI gateway and proxy server, affecting all versions from 1.74.2 through 1.83.6. This vulnerability enables unauthenticated remote code execution and follows the March 2026 LiteLLM supply chain compromise, indicating persistent exploitation risk in AI infrastructure dependencies.

Campaign Summary

FieldDetail
Campaign / MalwareLiteLLM Proxy Chain Compromise Campaign
AttributionMultiple actors (continuation from TeamPCP March 2026 incident) (confidence: medium)
TargetOrganizations using LiteLLM as an LLM API gateway; AI infrastructure operators
VectorUnauthenticated command injection via MCP configuration parameters in unpatched LiteLLM versions
Statusactive
First Observed2026-06-13

Detailed Findings

The LiteLLM supply chain compromise and the subsequent RCE vulnerability illustrate that point-in-time procurement assessments are insufficient; continuous vendor security evaluation is required for components with the trust posture of an AI gateway. This is a follow-on vulnerability to the March 2026 supply-chain incident, indicating systematic weakness in LiteLLM's development lifecycle. Organizations running affected versions are exposed to credential theft, model extraction, and lateral movement into AI infrastructure.

MITRE ATT&CK Mapping

TechniqueIDContext
Exploit Public-Facing ApplicationT1190Unauthenticated RCE via command injection in publicly accessible LiteLLM API
ProxyT1090LiteLLM itself serves as proxy layer for LLM API credentials; compromise centralizes credential exposure
Command and Scripting InterpreterT1059Command injection enables arbitrary shell execution on host

IOCs

Domains

_CVE-2026-42271 published 2026-06-13; exploitation details available in Horizon3.ai research_

Full URL Paths

_CVE-2026-42271 published 2026-06-13; exploitation details available in Horizon3.ai research_

Splunk Format

_No IOCs available for Splunk query_

Package Indicators

{'name': 'litellm', 'registry': 'pypi', 'version': '1.74.2-1.83.6', 'note': 'All versions in this range affected; patched in 1.83.7+'}

Affected Platforms

Python environments
AI API gateway deployments
Kubernetes clusters running LiteLLM
Cloud inference pipelines

Detection Recommendations

Defenders should: (1) immediately audit all LiteLLM instances for version 1.74.2-1.83.6 in production; (2) enable authentication on all LiteLLM API endpoints and rotate all stored credentials; (3) monitor for suspicious command execution on hosts running LiteLLM (shell expansion, process spawning); (4) implement network segmentation isolating LiteLLM from sensitive data/model endpoints; (5) migrate to patched version 1.83.7+ with application restart and credential rotation; (6) enable detailed request logging on LiteLLM with anomaly detection for unusual MCP configuration parameters.

References