LiteLLM: Authenticated command execution via MCP stdio test endpoints
High8.8CVE-2026-42271 · Published Apr 25, 2026 · updated Sep 10, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| litellm PyPI | >= 1.74.2, < 1.83.7 | 1.83.7 |
Details and references
### Impact Two endpoints used to preview an MCP server before saving it , `POST /mcp-rest/test/connection` and `POST /mcp-rest/test/tools/list` , accepted a full server configuration in the request body, including the `command`, `args`, and `env` fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user , including holders of low-privilege internal-user keys , could therefore run arbitrary commands on the host. ### Patches Fixed in **`1.83.7`**. Both test endpoints now require the `PROXY_ADMIN` role, bringing them into line with the save endpoint. ### Workarounds If upgrading is not immediately possible, developers should block `POST /mcp-rest/test/connection` and `POST /mcp-rest/test/tools/list` at their reverse proxy or API gateway.
More LiteLLM advisories
All LiteLLM| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Apr 24 | LiteLLM has SQL Injection in Proxy API key verification CVE-2026-42208Critical9.8fixed in 1.83.7 | Critical9.8 | 1.83.7 |
| Apr 24 | LiteLLM: Server-Side Template Injection in /prompts/test endpoint CVE-2026-42203Highfixed in 1.83.7 | High | 1.83.7 |
| May 11 | LiteLLM has a sandbox escape in custom-code guardrail CVE-2026-40217High8.8fixed in 1.83.10 | High8.8 | 1.83.10 |
| Apr 8 | LiteLLM: Password hash exposure and pass-the-hash authentication bypass GHSA-69x8-hrgq-fjj8Highfixed in 1.83.0 | High | 1.83.0 |
| Apr 3 | LiteLLM: Authentication bypass via OIDC userinfo cache key collision CVE-2026-35030Criticalfixed in 1.83.0 | Critical | 1.83.0 |
| Apr 3 | LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint CVE-2026-35029Highfixed in 1.83.0 | High | 1.83.0 |