CVE-2026-42271 is an OS command injection vulnerability (CWE-78) found in LiteLLM, a proxy server (AI Gateway) for Large Language Model APIs, as deployed in Red Hat products including OpenShift AI and Ansible Automation Platform. Two specific endpoints used for previewing an MCP server before saving it accept full server configurations including command execution parameters without sufficient role validation. An authenticated user, even with low-privilege internal-user API keys, can exploit this flaw by submitting a crafted configuration to execute arbitrary commands on the proxy host with the proxy process's privileges. This can lead to unauthorized code execution, data modification, denial of service, and concealment of malicious activities. Red Hat has acknowledged this as an important security flaw and released Red Hat OpenShift AI 3.4.1 with updated images and instructions for upgrading to mitigate the vulnerability. The CVSS base score is 8.8 (high severity) with low attack complexity and low privileges required. No public exploits are known at this time.

An authenticated user with low-privilege API keys can execute arbitrary operating system commands on the proxy host running LiteLLM. This can compromise confidentiality, integrity, and availability by allowing unauthorized code execution, data access or modification, denial of service, and hiding of malicious activities under the application's identity. The attack surface is limited to authenticated users with access to the vulnerable endpoints. The vulnerability affects Red Hat OpenShift AI and related products that include LiteLLM proxy components prior to version 3.4.1.

Red Hat has released Red Hat OpenShift AI version 3.4.1 which addresses this vulnerability. Users should upgrade to version 3.4.1 following the official Red Hat documentation to fully apply the errata update. No other mitigations or temporary fixes are indicated by the vendor advisory. Since this is not a cloud service, remediation requires applying the update to affected deployments. There are no known exploits in the wild, so applying the official update is the recommended course of action.