Command Injection (CVE‑2026‑42271) in BerriAI LiteLLM Allows Authenticated Users to Run Arbitrary Host Commands
What It Is — BerriAI LiteLLM contains a command‑injection flaw (CVE‑2026‑42271) that permits any authenticated user, including holders of low‑privilege internal‑user keys, to execute arbitrary operating‑system commands on the host running the library.
Exploitability — The vulnerability is exploitable by any authenticated attacker; proof‑of‑concept code is included in the CISA advisory. No public exploit kit is known, but the attack surface is low‑privilege credentials that are often widely distributed in CI/CD pipelines.
Affected Products — BerriAI LiteLLM (all versions prior to the vendor‑released patch).
Why It Matters for Trust & Control Assurance
- Highlights the need for strict least‑privilege IAM policies and continuous monitoring of privileged actions.
- Underscores the importance of immutable audit logs that capture command‑execution events for defensible evidence during audits.
- Shows that third‑party AI components must be incorporated into a control‑mapping program to demonstrate due‑diligence to regulators and enterprise buyers.
Recommended Actions
- Apply the vendor patch immediately once released.
- Review and tighten IAM roles for LiteLLM keys; enforce least‑privilege and rotate credentials regularly.
- Enable host‑level command‑execution logging and feed events into a SIEM or continuous‑monitoring platform.
- Map this finding to your control‑objective of “Secure Execution of Authorized Commands” and capture evidence for audit readiness.
Source: CISA KEV – CVE‑2026‑42271