Threat · curated 17 Jul 2026
CVE-2026-42271 - Red Hat Customer Portal
First reported · updated · 2 reports redhat.com
Coverage timeline
Why it matters
CVE-2026-42271 lets low-privileged authenticated users execute arbitrary commands on the host running the LiteLLM AI gateway, and with public exploits already circulating it directly threatens LLM-serving infrastructure in products like OpenShift AI and Ansible Automation Platform.
CVE-2026-42271 is an Important-severity (CVSS 8.8) flaw in LiteLLM, an AI gateway/proxy for LLM APIs, where two MCP-server preview endpoints accepted full server configurations including command-execution parameters without adequate role checks. An authenticated user with even low-privilege internal-user keys could send a crafted configuration to achieve arbitrary OS command execution on the proxy host; Red Hat notes known public exploits and the CVE is tracked in CISA's KEV catalog, with fixes shipped in LiteLLM v1.83.7-stable and Red Hat OpenShift AI / Ansible Automation Platform errata.
Summary
CVE-2026-42271 is an Important-severity OS command injection vulnerability (CWE-78) in LiteLLM, a proxy server / AI Gateway for Large Language Model APIs. Two endpoints used to preview an MCP server before saving accepted a full server configuration including command execution parameters, allowing an authenticated user—even one with low-privilege internal-user keys—to run arbitrary commands on the proxy host with the privileges of the proxy process.[0]
Red Hat assigns a CVSS v3 base score of 8.8 and marks the CVE as high risk with known public exploits, advising customers to address it with high priority; the flaw affects LiteLLM as consumed by Red Hat products including OpenShift AI and Ansible Automation Platform.[0][7]
Attack chain
- Access: An authenticated user obtains a LiteLLM API key; even a low-privilege internal-user key is sufficient because of insufficient role checks on the affected endpoints.[0]
- Exploitation: The attacker sends a crafted MCP server configuration to the endpoints used to preview an MCP server before saving; these endpoints accept command execution parameters.[0]
- Command execution: The crafted configuration causes arbitrary operating system commands to execute on the proxy host with the privileges of the proxy process, enabling code execution, data read/modify, and denial of service.[0]
Disclosure timeline
| Date | Event |
|---|---|
| May 8, 2026 | CVE-2026-42271 made public on the Red Hat Customer Portal.[0] |
| June 22, 2026 | Red Hat OpenShift AI 3.4 fix released via RHSA-2026:27784.[0] |
| June 24, 2026 | Red Hat OpenShift AI 2.25 fix released via RHSA-2026:28960.[0] |
| June 25, 2026 | Red Hat OpenShift AI 3.3 fix released via RHSA-2026:30056.[0] |
| June 30, 2026 | Red Hat CVE record last modified.[0] |
How it works
Two LiteLLM endpoints, intended for previewing an MCP server before saving it, accepted a full server configuration that included command execution parameters. Because of insufficient role checks, these endpoints could be invoked by any authenticated user, including holders of low-privilege internal-user keys, and the supplied command parameters were executed on the proxy host—a classic OS command injection (CWE-78) yielding arbitrary code execution with the proxy process's privileges.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| LiteLLM (upstream) | Versions prior to the fix; MCP stdio test/preview endpoints | Fixed in release v1.83.7-stable (GHSA-v4p8-mg3p-g94g)[0][5] |
| Red Hat OpenShift AI 2.25 (rhoai/odh-llama-stack-core-rhel9) | Affected | Fixed via RHSA-2026:28960 (June 24, 2026)[0] |
| Red Hat OpenShift AI 3.3 (rhoai/odh-llama-stack-core-rhel9) | Affected | Fixed via RHSA-2026:30056 (June 25, 2026)[0] |
| Red Hat OpenShift AI 3.4 (rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9) | Affected | Fixed via RHSA-2026:27784 (June 22, 2026)[0] |
| Red Hat Ansible Automation Platform 2 (lightspeed-chatbot-rhel9, 2.6 and 2.7) | Contains component but vulnerable code not in execute path | Not affected[0] |
| Red Hat OpenShift AI (rhoai/odh-mlflow-rhel9) and Exploit Intelligence (vulnerability-analysis-rhel9) | Contains component but vulnerable code not in execute path | Not affected[0] |
Key takeaways
- LiteLLM's MCP server preview endpoints allowed authenticated low-privilege users to inject command execution parameters, resulting in arbitrary OS command execution on the proxy host.[0]
- With known public exploits and CVSS 8.8, organizations running LiteLLM directly or via Red Hat OpenShift AI should patch to the fixed versions with high priority.[0][7]
Defensive actions
- Upgrade LiteLLM to the fixed release (v1.83.7-stable) and apply the relevant Red Hat errata (RHSA-2026:27784, RHSA-2026:28960, RHSA-2026:30056) for affected OpenShift AI versions.: These releases remediate the command execution vulnerability in the MCP preview endpoints.[0][5]
- Prioritize remediation given known public exploitation and the high CVSS 8.8 rating.: Red Hat marks the CVE as high risk with known public exploits and advises addressing it with high priority.[0][7]
- Restrict and audit LiteLLM API key issuance, recognizing that even low-privilege internal-user keys can reach the vulnerable endpoints.: The flaw is exploitable by authenticated low-privilege users due to insufficient role checks, so limiting authenticated access reduces exposure.[0]