When the AI Gateway Becomes the Weakest Link: Command Execution in LiteLLM's MCP Test Endpoints

AI gateways have quietly become production infrastructure. A single proxy that fronts OpenAI, Anthropic and local models is convenient, but it also concentrates credentials, routing logic and administrative reach into one service. CVE-2026-42271 is a reminder of what happens when a convenience feature on that service is built without a clear authorization model.

The feature that became the flaw

LiteLLM added MCP (Model Context Protocol) management endpoints starting in version 1.74.2. Two of them were designed to let administrators preview a connection before saving a configuration:

POST /mcp-rest/test/connection
POST /mcp-rest/test/tools/list

For the stdio transport, an MCP server configuration necessarily contains the executable, arguments and environment variables needed to launch that server. In protocol terms, starting a stdio server is an exec(command, args, env) call. The protocol itself does not specify who is allowed to supply that command. That decision belongs to whoever implements the gateway.
In the affected versions, the implementation made two mistakes in sequence.
The first was an authentication and authorization mismatch. The endpoints checked only whether the caller presented a valid proxy API key. They performed no role check. A virtual key generated through /key/generate, scoped to a single model with a small budget, had exactly the same access to these endpoints as an administrator key.
The second was a completely open execution surface. When the transport was stdio, the gateway used subprocess to launch a child process from the caller-supplied command, args and env values. There was no allowlist on the command field.
The result is that a low-privilege key can execute arbitrary commands with the privileges of the LiteLLM proxy process.

Scope and status

The advisory, tracked as GHSA-v4p8-mg3p-g94g, lists the affected range as LiteLLM versions from 1.74.2 up to, but not including, 1.83.7. The fix landed in 1.83.7. CVSS scores are 8.8 under v3.1 and 8.7 under v4.0.
CISA added CVE-2026-42271 to the Known Exploited Vulnerabilities catalog on June 8, 2026, confirming exploitation in the wild.
There is an important operational detail in the official Docker images: the proxy process runs as root. Command execution in that context is command execution as root on the gateway host.

Why the response body is misleading

A frequent source of confusion during testing is that the endpoint returns an error even when the command has already run. The request may return HTTP 200 with a body reporting that the connection to the MCP server failed. That failure is expected: a command like id does not speak the MCP JSON-RPC handshake, so the backend handshake aborts.
Process spawning and command execution happen before the MCP handshake completes. The correct way to judge whether execution occurred is to look for side effects, such as a written file, an outbound connection, or a callback, rather than reading the response body.

What the fix changed

The patch in 1.83.7 did two things. It required the PROXY_ADMIN role for both endpoints, and it added a validate_transport_fields() check that applies an allowlist to the stdio command field, permitting only npx, uvx, python, python3, node, docker and deno.
Both changes are necessary. The role check addresses the authorization gap. The allowlist reduces the execution surface even for legitimate administrators.
Independent testing has also noted that the published version range does not perfectly match observed behavior across every patch release, which is a good reason to verify the actual deployed version rather than trusting a version string alone.

The wider exploitation pattern

CVE-2026-42271 was not exploited in isolation. Researchers have documented a chain in which a single-character Bearer token bypasses MCP gateway authentication through CVE-2026-59822, a request smuggling issue in Starlette tracked as CVE-2026-48710 provides a host header bypass, and CVE-2026-42271 supplies the execution primitive. Combined, these allow unauthenticated remote code execution against an internet-reachable AI gateway.
Observed post-exploitation activity in this campaign included submitting forged MCP server configurations whose command field launched a Python downloader and a miner, while the test endpoint still returned what looked like a normal handshake to mask the abuse. Attackers also read the memory of running Python processes to recover the LiteLLM proxy master key, bypassing the key file on disk and the standard configuration paths.
Persistence techniques reported in related intrusions include modifying SSH keys, tampering with cron, disguising processes under normal service names, setting immutable file attributes, and installing startup hooks that survive reboots.

Defensive priorities

Upgrade. Move to a fixed release, and prefer a version that covers the broader chain rather than the minimum patch for this single CVE.
Treat API keys as identities with roles. A valid key is not the same thing as administrative authority. Any endpoint that starts processes, touches credentials, changes configuration, or reaches external services needs an explicit role check after authentication.
Constrain what can be launched. An allowlist on executable names is a meaningful reduction in blast radius for any feature that spawns subprocesses from user-supplied configuration.
Do not expose the gateway. An AI gateway that is reachable from the internet is an execution surface. Put it behind authentication and network controls, and restrict who can reach the management and test interfaces.
Watch for the tell-tale pattern. A test endpoint that returns a connection error while a child process has already run is a signature worth alerting on. Correlate gateway logs with process creation events and outbound network activity.
The broader lesson is that management and preview features deserve the same threat modeling as the data path. A convenience endpoint that helps an administrator validate a configuration can, without careful design, hand an attacker a command execution primitive on the host that holds every model credential in the environment.