CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Starlette

product · product:starlette

Coverage
1
first 2026-06-09 → last 2026-10-11
Latest activity
2026-06-09
CVE-2026-42271, BerriAI LiteLLM: low-privilege command injection to host RCE, added to CISA KEV
Peak priority
high
1 high
Targets
technology
sectors: technology
Sources cited
3
3 hosts

Action items (1)

Do-now tasks recorded on the entries about Starlette, newest first. Check the date before acting on an older one.

  • Upgrade every LiteLLM proxy to 1.83.7 or later: CVE-2026-42271 is KEV-listed and becomes unauthenticated when chained with CVE-2026-48710.
    2026-06-09CVE-2026-42271 +1

Defender insights

What each entry about Starlette tells a defender to do, newest first.

2026-06-09HIGHexploitedCVE-2026-42271, BerriAI LiteLLM: low-privilege command injection to host RCE, added to CISA KEV

Exposure · detection

Story timeline

  1. 2026-06-09CVE-2026-42271, BerriAI LiteLLM: low-privilege command injection to host RCE, added to CISA KEV
    trending-vulnerabilities

Hunting pivots

CVEs (exploited first)
CVE-2026-42271CVE-2026-48710
Releases covered
Starlette
Tags
actively-exploitedai-abusecisa-kevrcevulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ExecutionCommand and Scripting Interpreter

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-06-09/cve-2026-42271-berriai-litellm-low-privilege-command-injecti · ATT&CK page ↗

Execution TA0002

T1059Command and Scripting Interpreter×1

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.

Evidence: 2026-06-09/cve-2026-42271-berriai-litellm-low-privilege-command-injecti · ATT&CK page ↗

Entries about Starlette (1)

2026-06-09 · view entry permalink →

HIGHCVE-2026-42271 +1exploitedupdatedNATOB1

CVE-2026-42271, BerriAI LiteLLM: low-privilege command injection to host RCE, added to CISA KEV

CISA added CVE-2026-42271 to its KEV catalog on 8 June 2026, confirming active exploitation of a command-injection flaw in LiteLLM, the open-source AI gateway/proxy (CISA KEV catalog, 2026-06-08) (GitHub Advisory GHSA-v4p8-mg3p-g94g). Two preview endpoints, POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list, accept a full MCP server configuration (command, args, env) in the request body; with stdio transport, the proxy spawns the supplied command on the host under the proxy's privileges. The endpoints were gated only by a valid API key with no role check, so any authenticated user (including low-privilege internal keys) could execute arbitrary commands. Horizon3.ai documents that chaining with CVE-2026-48710 (a Starlette Host-header validation bypass) makes the path unauthenticated (Horizon3.ai, 2026-06-01). Affected: LiteLLM 1.74.2 to < 1.83.7; fixed in 1.83.7, which adds role-based authorization on the MCP test endpoints.

CVE Summary Table

CVE Product CVSS EPSS KEV Exploited Patch Source
CVE-2026-42271 BerriAI LiteLLM proxy (1.74.2 → < 1.83.7) 8.7 n/a Yes (2026-06-08) Yes (CISA-confirmed) Upgrade to 1.83.7 GitHub Advisory; CISA KEV catalog, 2026-06-08

When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process.

GitHub Advisory GHSA-v4p8-mg3p-g94g
Improvementrun 2026-10-11T1307Z-auditreferencesactionsbodyevent_datesourcing_note

LiteLLM 1.74.2 through 1.83.6 is affected and 1.83.7 fixes it, Starlette 1.0.0 or earlier makes the flaw reachable without authentication (Horizon3.ai, 2026-06-01), and the advisory's workaround is to block the two test endpoints at the reverse proxy or API gateway (GitHub Advisory GHSA-v4p8-mg3p-g94g).

Builds on: CVE-2026-48710 "BadHost", Starlette (FastAPI / vLLM / LiteLLM / MCP SDK): Pre-Auth Auth Bypass…

vulnerability09 Jun 05:00Zmulti-sourceOpen finding →
Sources: GitHub Advisory GHSA-v4p8-mg3p-g94g · Horizon3.ai analysis · CISA

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • cisa.gov1 (33%)
  • github.com1 (33%)
  • horizon3.ai1 (33%)
All cited sources (3)