LiteLLM MCP test-endpoint command injection (CVE-2026-42271) exploited to drop cryptominers

Not an October event: added to KEV on 2026-06-08. (KEV) This is not an email or document prompt injection case.

TL;DR: Any holder of a valid LiteLLM API key, even a low-privilege one, could run OS commands on the proxy host through the MCP "test" endpoints. Attackers used this to install cryptominers. Fixed in 1.83.7. (GHSA, Wiz)

Exploitation evidence

• CISA KEV: "BerriAI LiteLLM Command Injection Vulnerability", added 2026-06-08, due 2026-06-22, ransomware use Unknown. (KEV)
• Wiz Research: attackers submitted a fake MCP stdio server config whose command was a Python script. The script downloaded and ran a cryptominer, then returned a valid MCP handshake so the connection test appeared to succeed. (Wiz)

How the attack works

• POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list accepted a full stdio config (command, args, env). The supplied command was spawned as a subprocess with proxy privileges, and the only gate was a valid API key with no role check. (GHSA)
• In the Wiz sample, the miner (gmon) ran detached and its staging directory was deleted, leaving little on disk. (Wiz)

Indicators (Wiz, LiteLLM/MCP campaign)

What to do

• Upgrade to 1.83.7 or later; the test endpoints now require PROXY_ADMIN. If you can't yet, block both test endpoints at your reverse proxy. (GHSA)