ACVE-2026-0402

In the wild

exploited-itw · 2026-06-08 – 2026-06-08 · kev

Description

What

CVE-2026-42271 affects LiteLLM 1.74.2 through before 1.83.7 when an MCP server preview endpoint is available. The cited KEV classification identifies command injection in the preview flow. The record is about the gateway package and its preview configuration, not every MCP server managed by LiteLLM.

Which configuration is exposed

The exposed setup is a LiteLLM gateway in the reported version range with an MCP-server preview path reachable by an attacker or untrusted caller. A package installed but never used as a gateway is not enough to confirm the configuration.

How ACVE detects it

ACVE matches the PyPI package and resolved version recorded on an MCP server entry. Static discovery does not invoke preview APIs or verify authorization, so absent endpoint details remain possible. The same server element must carry the package and version conditions.

Fix

Upgrade to 1.83.7 or later, disable preview functionality until the upgrade is complete, and require authentication at the gateway. Review commands and credentials available to the LiteLLM process.

Grounding needed

Grounding should verify the KEV entry and the OSV/GHSA affected range. The research gives no exact victim count, so the record preserves that uncertainty.

This record is limited to the condition named in the public source: LiteLLM MCP preview endpoint reaches command injection. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.

Configuration

some mcpServers where
  and
    package eq "pkg:pypi/litellm"
    resolvedVersion semverRange ">=1.74.2 <1.83.7"

Fix

Upgrade LiteLLM to 1.83.7 or later and restrict preview endpoints.

• Upgrade pypi:litellm to 1.83.7. Use the fixed release.
• Reconfigure mcpServers.urlHost. Keep the gateway behind authentication.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

No references recorded.