{"id":"PYSEC-2026-2599","summary":"LiteLLM: Authenticated command execution via MCP stdio test endpoints","details":"### Impact\n\nTwo endpoints used to preview an MCP server before saving it — `POST /mcp-rest/test/connection` and `POST /mcp-rest/test/tools/list` — accepted a full server configuration in the request body, including the `command`, `args`, and `env` fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process.\n\nThe endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host.\n\n### Patches\n\nFixed in **`1.83.7`**. Both test endpoints now require the `PROXY_ADMIN` role, bringing them into line with the save endpoint.\n\n### Workarounds\n\nIf upgrading is not immediately possible, developers should block `POST /mcp-rest/test/connection` and `POST /mcp-rest/test/tools/list` at their reverse proxy or API gateway.","aliases":["CVE-2026-42271","GHSA-v4p8-mg3p-g94g"],"modified":"2026-07-13T16:32:04.086728418Z","published":"2026-07-13T15:02:53.541330Z","references":[{"type":"WEB","url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42271"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable"},{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42271"},{"type":"PACKAGE","url":"https://pypi.org/project/litellm"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-v4p8-mg3p-g94g"}],"affected":[{"package":{"name":"litellm","ecosystem":"PyPI","purl":"pkg:pypi/litellm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.74.2"},{"fixed":"1.83.7"}]}],"versions":["1.74.12","1.74.14","1.74.15","1.74.15.post1","1.74.15.post2","1.74.2","1.74.3","1.74.3.post1","1.74.3rc1","1.74.3rc2","1.74.3rc3","1.74.4","1.74.4.dev1","1.74.6","1.74.7","1.74.7.post1","1.74.7.post2","1.74.7rc1","1.74.8","1.74.8.dev2","1.74.9","1.74.9.dev1","1.74.9.dev2","1.74.9.post1","1.74.9.post2","1.75.0","1.75.2","1.75.3","1.75.4","1.75.5.post1","1.75.5.post2","1.75.6","1.75.7","1.75.8","1.75.9","1.76.0","1.76.1","1.76.2","1.76.3","1.77.0","1.77.1","1.77.2.post1","1.77.3","1.77.4","1.77.4.dev1","1.77.5","1.77.7","1.78.0","1.78.0rc2","1.78.2","1.78.3","1.78.4","1.78.5","1.78.6","1.78.7","1.79.0","1.79.0.dev1","1.79.0.dev2","1.79.0.dev3","1.79.1","1.79.2","1.79.3","1.79.3.dev8","1.80.0","1.80.10","1.80.11","1.80.12","1.80.13","1.80.15","1.80.16","1.80.17","1.80.5","1.80.6","1.80.7","1.80.8","1.80.9","1.81.0","1.81.1","1.81.10","1.81.11","1.81.12","1.81.13","1.81.14","1.81.15","1.81.16","1.81.3","1.81.4","1.81.5","1.81.6","1.81.7","1.81.8","1.81.9","1.81.9.dev1","1.82.0","1.82.1","1.82.2","1.82.3","1.82.4","1.82.5","1.82.6","1.83.0","1.83.1","1.83.2","1.83.3","1.83.4","1.83.5","1.83.6"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/litellm/PYSEC-2026-2599.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N"}]}