{"id":"litellm-command-injection-attacks-apr-2026","category":"patch","status":"closed","title":"LiteLLM command injection CVE-2026-42271 used in attacks; fixes available","tldr":"Attackers are using a LiteLLM AI gateway flaw that lets even low-privilege users run code on its server. Organisations should update to 1.83.7 or later, apply relevant Red Hat fixes and check for compromise.","summary":"BerriAI LiteLLM, software organisations use to connect applications to AI services, had a flaw in functions for testing Model Context Protocol (MCP) server connections. A valid LiteLLM API key was enough to run commands with the gateway process's permissions, even if the key belonged to a low-privilege user. BerriAI identifies versions 1.74.2 to before 1.83.7 as affected and fixed the flaw in 1.83.7, released on 19 April. CISA confirmed exploitation by adding it to its catalogue on 8 June. Red Hat subsequently shipped fixes for affected OpenShift AI components on 22–25 June. October research from Black Lotus Labs identified this vulnerability as a likely entry route for PoeLLM, malware that mines cryptocurrency and reuses compromised servers to attack others. Fixes are available, but the research reported continuing infections; it did not establish that the campaign had ended.","action":"If your business or family office runs LiteLLM, ask its IT team to update to a supported release at least as new as 1.83.7, or install the applicable Red Hat security update. If updating must wait, BerriAI says to block POST requests to /mcp-rest/test/connection and /mcp-rest/test/tools/list at the reverse proxy or API gateway. Ask IT to check for compromise as well as patching.","product":"BerriAI LiteLLM AI gateway and affected Red Hat OpenShift AI components","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-42271"],"tags":["berriai","litellm","ai-gateway","command-injection","actively-exploited","red-hat","cryptomining"],"affected":["LiteLLM >=1.74.2, <1.83.7","Red Hat OpenShift AI 3.4: rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9 before RHSA-2026:27784","Red Hat OpenShift AI 3.3: rhoai/odh-llama-stack-core-rhel9 before RHSA-2026:30056","Red Hat OpenShift AI 2.25: rhoai/odh-llama-stack-core-rhel9 before RHSA-2026:28960"],"fixed":["LiteLLM >=1.83.7; stable release v1.83.7-stable","Red Hat OpenShift AI 3.4: RHSA-2026:27784","Red Hat OpenShift AI 3.3: RHSA-2026:30056","Red Hat OpenShift AI 2.25: RHSA-2026:28960"],"matches":[],"sources":[{"kind":"advisory","title":"Authenticated command execution via MCP stdio test endpoints","url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g","by":"BerriAI","date":"2026-04-21"},{"kind":"advisory","title":"Release v1.83.7-stable","url":"https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable","by":"BerriAI","date":"2026-04-19"},{"kind":"advisory","title":"CISA Known Exploited Vulnerabilities catalogue — official data","url":"https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json","by":"CISA","date":"2026-11-03"},{"kind":"advisory","title":"CVE-2026-42271","url":"https://access.redhat.com/security/cve/cve-2026-42271","by":"Red Hat","date":"2026-06-30"},{"kind":"research","title":"Canto incognito: tracking the PoeLLM malware","url":"https://www.lumen.com/blog/en-us/canto-incognito-tracking-the-poellm-malware","by":"Lumen Black Lotus Labs","date":""},{"kind":"news","title":"Cryptomining malware used poetry to infect more than 3,400 servers, researchers say","url":"https://www.tomshardware.com/tech-industry/cyber-security/cryptomining-malware-used-poetry-to-infect-more-than-3-400-servers-researchers-say-four-words-in-the-poellm-verse-changed-11-times-point-the-botnet-to-new-servers","by":"Tom's Hardware","date":"2026-10-11"}],"started":"2026-06-08","closed":"2026-10-11","created":"2026-11-03T22:20:25.870Z","updated":"2026-11-03T22:20:25.870Z","cve_notes":[{"cve":"CVE-2026-42271","name":"Command injection in LiteLLM's MCP test functions","what":"Missing administrator-role checks in LiteLLM's MCP connection and tool-list tests let an authenticated user with a low-privilege API key run commands with the server process's permissions.","severity":"high","cvss":8.7}],"timeline":[{"at":"2026-10-11","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"Reporting on Black Lotus Labs' PoeLLM investigation linked CVE-2026-42271 to the campaign as a likely route into LiteLLM servers. The cryptomining campaign was still infecting systems when the research was published; its victims spanned several products.","url":"https://www.tomshardware.com/tech-industry/cyber-security/cryptomining-malware-used-poetry-to-infect-more-than-3-400-servers-researchers-say-four-words-in-the-poellm-verse-changed-11-times-point-the-botnet-to-new-servers","by":"Tom's Hardware","patch":null},{"at":"2026-06-25","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Red Hat released RHSA-2026:30056 for OpenShift AI 3.3's affected Llama Stack core component. Its current assessment lists fixes for all three affected OpenShift AI entries.","url":"https://access.redhat.com/security/cve/cve-2026-42271","by":"Red Hat","patch":"patched"},{"at":"2026-06-24","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Red Hat released RHSA-2026:28960 for the affected Llama Stack core component in OpenShift AI 2.25.","url":"https://access.redhat.com/security/cve/cve-2026-42271","by":"Red Hat","patch":"partial"},{"at":"2026-06-22","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Red Hat released RHSA-2026:27784 for the affected TrustyAI Garak LLS provider component in OpenShift AI 3.4.","url":"https://access.redhat.com/security/cve/cve-2026-42271","by":"Red Hat","patch":"partial"},{"at":"2026-06-08","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-42271 to its Known Exploited Vulnerabilities catalogue, confirming use in attacks. It set a 22 June remediation deadline for US federal civilian agencies; ransomware use was unknown.","url":"https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json","by":"CISA","patch":null},{"at":"2026-04-21","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"BerriAI published its advisory: LiteLLM versions from 1.74.2 to before 1.83.7 let users with low-privilege API keys run commands on the server. Version 1.83.7 restricts the affected test functions to proxy administrators.","url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g","by":"BerriAI","patch":null},{"at":"2026-04-19","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"BerriAI released LiteLLM v1.83.7-stable, the release its advisory identifies as fixing CVE-2026-42271.","url":"https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable","by":"BerriAI","patch":"partial"}],"url":"https://hard.fyi/live/litellm-command-injection-attacks-apr-2026/","json":"https://hard.fyi/api/live?id=litellm-command-injection-attacks-apr-2026"}