LiteLLM RCE: your AI gateway is now attack surface

If you route your AI calls through a proxy so you can swap providers, cap spend, and log usage — good instinct, we recommend it. But that proxy is a server that holds every API key you own, and this week it became a live target. A critical flaw in LiteLLM, one of the most widely deployed open-source AI gateways, is being exploited in the wild.

What actually happened

CVE-2026-42271 is a command-injection flaw (CVSS 8.7) in LiteLLM versions ≥ 1.74.2 through < 1.83.7. Per The Hacker News, two MCP test endpoints accepted a full server configuration in the request body and spawned the supplied command as a subprocess on the proxy host — no allowlist, no admin gate. Any holder of a proxy API key could run arbitrary commands on the box.

It gets worse. Researchers at Horizon3.ai chained it with CVE-2026-48710, a "BadHost" host-header bypass in the Starlette framework, to reach unauthenticated remote code execution from any network-reachable host — a combined CVSS of 10.0. A successful attacker runs commands on the host, then reads the model-provider credentials the proxy stores: your Anthropic, OpenAI, and other keys, plus a path into whatever those keys can reach. CISA added the flaw to its Known Exploited Vulnerabilities catalog on June 8, 2026, citing active exploitation. The fix ships in LiteLLM 1.83.7, which gates both endpoints behind the PROXY_ADMIN role; patch Starlette to a fixed release too.

Why it matters for your business

The AI proxy is the highest-value box in a modern stack because it concentrates secrets. One host, every key. That's convenient for you and convenient for whoever takes it. If you or a vendor stood up an AI gateway in the last year and haven't looked at it since, it is probably running a vulnerable version right now, and "internal only" is not protection — the unauthenticated chain works from any host that can reach the port.

Three moves, today. Pin the version and update LiteLLM to 1.83.7+ (and Starlette). Put the gateway behind network controls so it isn't reachable from the open internet or your whole flat LAN. And rotate the provider keys it holds — if it was exposed, assume they walked. The broader lesson: every convenience layer you add to move fast is also a thing that can be attacked, and AI infrastructure is new enough that a lot of it shipped without the boring security review the rest of your stack gets.

Sources: The Hacker News, Horizon3.ai.