{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0402",
  "aliases": [
    "CVE-2026-42271"
  ],
  "modified": "2026-09-20T00:00:00Z",
  "summary": "LiteLLM MCP preview endpoint reaches command injection",
  "details": "## What\n\nCVE-2026-42271 affects LiteLLM 1.74.2 through before 1.83.7 when an MCP server preview endpoint is available. The cited KEV classification identifies command injection in the preview flow. The record is about the gateway package and its preview configuration, not every MCP server managed by LiteLLM.\n\n## Which configuration is exposed\n\nThe exposed setup is a LiteLLM gateway in the reported version range with an MCP-server preview path reachable by an attacker or untrusted caller. A package installed but never used as a gateway is not enough to confirm the configuration.\n\n## How ACVE detects it\n\nACVE matches the PyPI package and resolved version recorded on an MCP server entry. Static discovery does not invoke preview APIs or verify authorization, so absent endpoint details remain possible. The same server element must carry the package and version conditions.\n\n## Fix\n\nUpgrade to 1.83.7 or later, disable preview functionality until the upgrade is complete, and require authentication at the gateway. Review commands and credentials available to the LiteLLM process.\n\n## Grounding needed\n\nGrounding should verify the KEV entry and the OSV/GHSA affected range. The research gives no exact victim count, so the record preserves that uncertainty.\n\nThis record is limited to the condition named in the public source: LiteLLM MCP preview endpoint reaches command injection. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.",
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "litellm"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "1.74.2"
            },
            {
              "fixed": "1.83.7"
            }
          ]
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "code",
      "vulnClasses": [
        "command-injection",
        "exposed-surface"
      ],
      "cwe": [
        "CWE-306"
      ],
      "exploitation": {
        "status": "exploited-itw",
        "checkedAt": "2026-09-20T00:00:00Z",
        "sources": [
          {
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42271",
            "type": "kev"
          }
        ],
        "kev": {
          "listed": true
        },
        "first_seen": "2026-06-08",
        "last_seen": "2026-06-08",
        "victims": {
          "range": "unverifiable",
          "sectors": [
            "technology"
          ],
          "evidence": "CISA KEV lists the CVE without a public victim count."
        },
        "attribution": "unattributed"
      },
      "cveBoundary": "cve-aliased",
      "matcher": {
        "some": "mcpServers",
        "where": {
          "all": [
            {
              "field": "package",
              "op": "eq",
              "value": "pkg:pypi/litellm"
            },
            {
              "field": "resolvedVersion",
              "op": "semverRange",
              "value": ">=1.74.2 <1.83.7"
            }
          ]
        }
      },
      "fix": {
        "summary": "Upgrade LiteLLM to 1.83.7 or later and restrict preview endpoints.",
        "actions": [
          {
            "type": "upgrade",
            "target": "pypi:litellm",
            "to": "1.83.7",
            "why": "Use the fixed release."
          },
          {
            "type": "reconfigure",
            "target": "mcpServers.urlHost",
            "why": "Keep the gateway behind authentication."
          }
        ]
      },
      "grounding": {
        "itw": {
          "checkedAt": "2026-09-20T16:26:21Z",
          "sources": [
            {
              "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42271",
              "status": 200,
              "contentType": "text/html",
              "sha256": "sha256:6884021d2cf8f460691d264336c8fdba766d1bd0fd787856a7bb2fb18271b949",
              "type": "kev"
            }
          ],
          "kev": {
            "listed": true
          }
        }
      }
    }
  }
}