Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

LiteLLM endpoint-hardening patch release (CVE-2026-42271)

Security Patch Release
First reported
Last updated
Happening score
H score 59
1 unique sources, 1 articles

Summary

Hide ▲

BerriAI released LiteLLM 1.83.7, hardening access to the vulnerable MCP test endpoints that accepted full server configurations. The update now requires the PROXY_ADMIN role for both endpoints, aligning them with the save endpoint and closing the weaker access-control path. The release addresses CVE-2026-42271 in LiteLLM versions >= 1.74.2 < 1.83.7, a command-injection flaw that could let authenticated users run arbitrary commands on the proxy host.

Related Happenings

Squid web proxy patch for CVE-2026-47729

Security Patch Release
H score20 First: 22.06.2026 17:29 Last: 22.06.2026 17:29 Sources 1

About this happening: Squid maintainers merged a null-terminator check for CVE-2026-47729 into the development branch and v7, closing the FTP-parser over-read that could expose shar...

Open Happening

Cisco Unified Communications Manager security update for CVE-2026-20230

Security Patch Release
H score56 First: 04.06.2026 14:09 Last: 04.06.2026 14:09 Sources 1

About this happening: Cisco released security updates for Cisco Unified Communications Manager (Unified CM) to fix CVE-2026-20230, a critical flaw that could let a remote attacker reach...

Open Happening

LiteSpeed cPanel user-end plugin urgent security update (CVE-2026-48172)

Security Patch Release
H score42 First: 27.05.2026 13:06 Last: 27.05.2026 13:06 Sources 1

About this happening: LiteSpeed released urgent security updates for the cPanel user-end plugin after CVE-2026-48172 was found to be actively exploited, reducing exposure for systems ru...

Latest development: 16.06.2026 13:47

CISA added CVE-2026-48172/CVE-2026-54420 in the LiteSpeed cPanel user-end plugin to the Known Exploited Vulnerabilities Catalog and ordered Federal Civilian Executive Branch agencies to secure affected servers within three days under BOD 26-04. The affected plugin versions before 2.4.8 are described as actively exploited, with FTP or web shell access enabling root escalation on shared hosting servers running CloudLinux/CageFS.

Open Happening

Cisco Secure Workload REST API patch release (CVE-2026-20223)

Security Patch Release
H score55 First: 22.05.2026 08:36 Last: 22.05.2026 08:36 Sources 1

About this happening: Cisco patched CVE-2026-20223, a CVSS 10.0 Secure Workload REST API flaw that could expose sensitive data and allow configuration changes across tenant boundaries. The upda...

Open Happening

Ivanti security patch release for CVE-2026-8043

Security Patch Release
H score25 First: 18.05.2026 13:54 Last: 18.05.2026 13:54 Sources 1

About this happening: Ivanti, Fortinet, SAP, Broadcom, and n8n released security fixes on 2026-05-18 for flaws that could enable authentication bypass, remote code execution, SQL...

Open Happening

Timeline

  1. 09.06.2026 09:26 2 articles · 1mo ago

    LiteLLM 1.83.7 requires PROXY_ADMIN on MCP test endpoints

    Mitigation Patch Update

    BerriAI released LiteLLM 1.83.7 and hardened the MCP preview workflow so POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list now require the PROXY_ADMIN role, matching the save endpoint and closing the command-injection path tracked as CVE-2026-42271 in LiteLLM Python package versions >= 1.74.2 < 1.83.7.

    Show sources
    Open in new tab
  2. 09.06.2026 09:26 1 articles · 1mo ago

    CISA adds CVE-2026-42271 in LiteLLM to KEV after active exploitation

    Initial Disclosure

    CISA added CVE-2026-42271 in BerriAI LiteLLM to its Known Exploited Vulnerabilities (KEV) catalog after evidence of active exploitation, and Horizon3.ai said the flaw could be chained with CVE-2026-48710 in Starlette versions ≤ 1.0.0 to bypass authentication and achieve unauthenticated remote code execution against vulnerable LiteLLM deployments.

    Show sources
    Open in new tab