LiteLLM Unauthenticated Remote Code Execution via Starlette Host Header Validation Bypass

CVE-2026-42271 is a command injection vulnerability in LiteLLM’s MCP server test endpoints that was originally disclosed as requiring authentication. Horizon3.ai researchers confirmed that when chained with CVE-2026-48710, a Starlette “BadHost” Host Header validation bypass vulnerability, the authentication requirement can be bypassed entirely. The result is unauthenticated remote code execution against vulnerable LiteLLM deployments, allowing attackers to execute commands as the LiteLLM proxy process. Affected LiteLLM versions include 1.74.2 through 1.83.6.

Technical Details

CVE-2026-42271 affects the following LiteLLM MCP server endpoints:

• POST /mcp-rest/test/connection
• POST /mcp-rest/test/tools/list

These endpoints accept a complete server configuration, including command, arguments, and environment variables used by the stdio transport. When invoked, LiteLLM spawns the supplied command as a subprocess on the proxy host. The issue was originally considered authenticated because access was gated by a valid proxy API key.

Horizon3.ai researchers validated that CVE-2026-48710 can be used to bypass the authentication mechanism entirely in LiteLLM deployments whose dependency tree includes Starlette versions ≤ 1.0.0. This transforms the vulnerability into unauthenticated remote code execution with no credentials required.

Successful exploitation allows attackers to:

• Execute arbitrary commands on the LiteLLM host
• Access model provider credentials
• Steal API keys and secrets stored by the proxy
• Move laterally into connected AI infrastructure
• Compromise downstream systems integrated with the gateway

The chained vulnerability has been assessed as CVSS 10.0 Critical.organizations relying on self-hosted Gitea environments.

Stop Guessing, Start Proving