CVE-2026-42271 is a critical-severity vulnerability. AttackerView checks LiteLLM sites for it with a live exploit check.
Detects LiteLLM AI gateways whose MCP server preview endpoints spawn whatever command the request body names. The proxy lets an administrator try out an MCP server before saving it, and the two preview endpoints take the whole server definition from the request, including the command, arguments and environment the stdio transport uses. Trying the connection means starting that command as a child of the proxy, with the proxy's privileges. Releases from 1.74.2 up to 1.83.6 ran that for anyone who got past the key check and never looked at the caller's role, so the holder of an ordinary low privilege key could run commands on the host. A proxy started without a master key is worse still: LiteLLM then treats every anonymous caller as an internal user, which puts the preview endpoints on the internet with no credential at all. That is the shape this check proves. It sends four preview requests that differ only in how long the spawned program is asked to sleep, two of them asking for nothing, and reads the response times back. A proxy that really started the program holds each response for the number of seconds this scan picked; a patched one answers every request immediately with HTTP 403 and a message naming the administrator role it now requires. Only a sleep is ever executed and nothing is written or saved. The process that would run an attacker's command is the one holding every upstream provider key, every virtual key the gateway has issued, and the gateway master key. CVSS 8.8. Upgrade LiteLLM to 1.83.7 or later, and set a master key so anonymous callers stop being treated as internal users.
Is your app exploitable through CVE-2026-42271?
Scan your domain free