BerriAI's LiteLLM — a proxy server that fronts calls to OpenAI-format LLM APIs and has become a default piece of "AI gateway" infrastructure for organizations running multiple model providers behind one interface — had two confirmed-exploited vulnerabilities land in CISA's KEV catalogue within roughly a month of each other, both patched in the same v1.83.7 release.
| CVE | CVSS | Flaw | Added to KEV |
|---|---|---|---|
| CVE-2026-42208 | 9.8 | SQL injection in API key checks | 8 May 2026 |
| CVE-2026-42271 | 8.8 | Command injection via MCP preview endpoints | 8 Jun 2026 |
An unauthenticated database compromise and an authenticated command execution, in the same product, one release apart
CVE-2026-42208 is the more severe of the two by CVSS score, and the mechanism is a textbook lesson in why string-concatenated SQL still matters in 2026: per NVD, "a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter." Because API key validation runs on essentially every request, an unauthenticated attacker could send "a specially crafted Authorization header to any LLM API route (for example POST /chat/completions)" and reach the vulnerable query through the proxy's error-handling path — meaning the entry point wasn't some obscure admin panel, it was the exact same endpoint every legitimate API call already uses. The result, per NVD, is that an attacker "could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages." In an AI gateway, "the credentials it manages" means the upstream API keys for every LLM provider the organization has configured behind it — a single injection point with a blast radius spanning every model integration routed through that proxy.
CVE-2026-42271 is a different failure with a similarly broad reach: two endpoints meant to let administrators preview an MCP (Model Context Protocol) server configuration before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration including the command, args, and env fields used for the stdio transport. NVD is explicit that "when called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process," and crucially, "the endpoints were gated only by a valid proxy API key, with no role check" — meaning "any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host." A feature built to let administrators safely test a new integration before committing to it instead let any authenticated caller, regardless of intended privilege level, execute shell commands on the proxy host itself.
Why "preview before you save" and "check the key" are exactly the functions attackers target
Both vulnerabilities sit in code paths whose entire purpose is verification — one checks whether an API key is valid, the other checks whether an MCP server configuration works before it's persisted. That is not a coincidence worth glossing over: verification and preview endpoints are attractive targets precisely because they are designed to accept and process untrusted or exploratory input by design, which means the engineering discipline applied to them has to be at least as strict as the discipline applied to the "real" data path — and in both of these cases, it wasn't. The MCP preview endpoint needed a role check that would have limited it to actual administrators; the API key check needed parameterized queries instead of string concatenation. Neither fix is exotic. Both were, however, missing in a product that had already become widely deployed AI infrastructure by the time they were found.
What to check this week
Upgrade to LiteLLM v1.83.7 or later immediately — this single release addresses both CVEs, so there is no reason to patch one without the other.
Rotate all credentials the proxy manages if the deployment predates the patch and has any internet-reachable exposure, since CVE-2026-42208 is unauthenticated and specifically enables reading and potentially modifying the proxy's own database, including stored credentials.
Review who holds internal-user API keys, given that CVE-2026-42271 shows even the lowest privilege tier of authenticated access was sufficient for arbitrary command execution — a finding that should prompt a broader look at what "low-privilege" actually means in this product's role model.
Audit MCP server integrations configured through the proxy, checking logs for unexpected connection attempts to the test endpoints, particularly any using stdio transport with unfamiliar command values.
A closing note on AI infrastructure inheriting old vulnerability classes
Neither of these bugs is novel as a vulnerability class — SQL injection via unparameterized queries and command execution via unchecked subprocess spawning are among the oldest categories in the field. What's notable is that they appeared in a product built specifically to sit in front of large language model APIs, a category of software still young enough that its engineering practices haven't yet absorbed decades of prior lessons the way, say, mainstream web frameworks eventually did. The AI infrastructure boom is currently producing exactly the kind of gateway and orchestration software this cluster describes, at a pace that outstrips the security review such centralized, credential-holding components deserve.
A final consideration on gateway consolidation risk
Organizations adopt a proxy like LiteLLM precisely to centralize and simplify how they call multiple LLM providers — but that consolidation also concentrates risk: a single flaw in the gateway now has reach across every model integration behind it, rather than being contained to one provider's individual credentials.
How Safeguard helps
Safeguard's continuous inventory extends to AI infrastructure components like LLM gateways and proxies, tracking version and patch status with the same rigor applied to any other credential-holding piece of middleware — so that a fast-moving product category doesn't become a blind spot simply because it's new.
