LiteLLM Command Injection Hits CISA KEV as Attackers Chain to RCE

CISA dropped a new entry into its Known Exploited Vulnerabilities catalog on Monday, and this one will sting anyone running a self-hosted LLM gateway.

The bug is CVE-2026-42271, a command injection flaw in BerriAI's LiteLLM proxy. CVSS 8.7. Any authenticated user can execute arbitrary shell commands on the host running the proxy. CISA says it's seen evidence of active exploitation.

If you haven't been tracking LiteLLM, here's the short version: it's the duct tape a lot of platform teams use to put a unified OpenAI-compatible API in front of a dozen model providers — OpenAI, Anthropic, Bedrock, Vertex, self-hosted vLLM, whatever. It's become the default proxy layer for internal AI platforms. Which means it usually sits with API keys for every model vendor your company pays, plus a fat IAM role on the underlying EKS or GKE node.

The failure mode here is predictable. "Authenticated user" in a LiteLLM deployment often means "anyone who got a virtual API key from the self-service portal your AI platform team stood up." In practice that's a much bigger blast radius than the CVSS string suggests. Auth is not a meaningful barrier when the entire point of the system is to hand out tokens to internal devs and, in some shops, contractors.

Once you have shell on the proxy pod, the loot is obvious. Provider API keys in environment variables. The IRSA or workload identity binding on the pod. The Redis or Postgres backend holding usage logs and, frequently, full prompt and completion histories. From there it's the usual lateral path into the cluster metadata service if the pod isn't locked down.

BerriAI has been patching a steady stream of these. The project's security advisories on GitHub are worth pinning to your dashboard if you run this in prod. Upgrade to a current release, rotate every provider key the proxy has ever touched, and audit the virtual key table for anything you don't recognize.

Federal civilian agencies have until CISA's KEV deadline to remediate. Everyone else should treat that deadline as a courtesy.

One thing the post-mortem will say: the AI platform got shipped on the security model of an internal tool, then quietly grew into critical infrastructure holding the company's most sensitive prompts. Nobody re-threat-modeled it.

Operational takeaway: if LiteLLM is in your stack, patch it this week, scope its IAM role to the minimum, and stop putting raw provider keys in pod env vars — use a secrets broker and short-lived credentials.