CISA Adds LiteLLM Flaw to Exploited Vulnerabilities; Unauthenticated RCE Threatens AI Gateways

On June 9, CISA added CVE-2026-42271 to its Known Exploited Vulnerabilities catalog, giving federal agencies 13 days to patch a command injection flaw in LiteLLM, a widely used open-source AI gateway. The affected endpoints — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — are Model Context Protocol interfaces where AI agents connect to data sources and tools. On its own, exploitation requires credentials, but chaining with CVE-2026-48710, a BadHost/Starlette authentication bypass, eliminates that requirement, enabling unauthenticated remote code execution. This is the second LiteLLM vulnerability weaponized in active attacks within a month, and CISA described the pattern as “sustained targeting of AI gateway infrastructure.”

Beyond the immediate patch, the flaw exposes a deeper governance gap. AI gateways like LiteLLM occupy a privileged position between enterprise data systems and AI models, with over 200 data connectors. Paras Malhotra, CISO of Starburst, noted that security teams have not applied service account governance—credential rotation, scoped access, audit trails—to AI agents. Most agents have permissions mirroring the engineer who provisioned them, not minimum necessary scope. With no credential rotation or periodic review, a compromised gateway gives attackers access to document repositories, code bases, and financial data warehouses without needing credentials for each downstream system. The blast radius is limited only by what the gateway can reach.