CVE-2026-42271 BerriAI Litellm
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST…
- CVSS
- 8.7 High
- EPSS
- 91%
- Percentile
- 100
- Published
- 2026-05-08
- Force
- 10 of 12
- Public PoC
- 2
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N
On CISA’s exploited list
BerriAI LiteLLM Command Injection Vulnerability
- Added
- 2026-06-08
- Federal patch deadline
- 2026-06-22
- Ransomware use
- not known