LiteLLM and Starlette vulnerabilities chained for remote code execution
LiteLLM's command injection vulnerability (CVE-2026-42271), confirmed by US CISA as actively exploited, can reportedly be chained with a Starlette framework flaw to bypass authentication and achieve remote code execution in self-hosted development environments using the open-source LLM connector tool.
What happened
On June 8, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed active exploitation of a high-risk vulnerability in LiteLLM (CVE-2026-42271), a command injection flaw, and added it to the Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to patch by June 22.
Threat intelligence firm Horizon3.ai warned that attackers could chain CVE-2026-42271 with a medium-risk vulnerability in the Python asynchronous framework Starlette (CVE-2026-48710) to bypass LiteLLM authentication entirely and achieve remote code execution with CVSS score 10.0 in self-hosted Gitea development environments.
Reported impact
The vulnerability chain would allow attackers to execute arbitrary commands through the LiteLLM proxy service after bypassing authentication, affecting LiteLLM deployments that use Starlette as a proxy server or API gateway.
Index analysis
Horizon3.ai noted that although Starlette is not required for LiteLLM, many users adopt it because LiteLLM offers proxy server modes and documentation typically uses FastAPI examples; FastAPI is built on Starlette and Pydantic, making the attack scenario likely in real-world LiteLLM platforms.
Governance controls
CISA required federal agencies to patch the vulnerability by June 22, 2026, and BerriAI released patch version 1.83.7. Horizon3.ai urged users to update both LiteLLM and Starlette.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.