Search: CVE-2026-42271

CVE-2026-42271 is a command injection vulnerability in BerriAI's LiteLLM proxy server versions 1.74.2 up to but not including 1.83.7. Two endpoints allowed authenticated users, including those with low-privilege API keys, to execute arbitrary commands on the proxy host by submitting crafted server configurations. This flaw arises from insufficient role checks and improper neutralization of command execution parameters. The vulnerability has been patched in version 1.83.7.