NewsThe Hacker News
LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE
Affected vendors and products
More on LiteLLM
Other advisories
- Not ratedosv:CLEANSTART-2026-AQ37229LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format
- Not ratedosv:CLEANSTART-2026-HA67725LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format
- Not ratedosv:CLEANSTART-2026-YD37887Security fix for CVE-2026-112913 applied in: litellm-database 1.104.8-r0
- Not ratedosv:CLEANSTART-2026-WD98251Security fix for CVE-2026-112907 applied in: litellm-database 1.104.8-r0
- Not ratedosv:CLEANSTART-2026-PH08344Security fix for GHSA-7gcm-g887-7qv7 applied in: litellm-database 1.103.9-r3
- Not ratedosv:GHSA-g5ff-637f-6q2mLiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`
- Highghsa:GHSA-g5ff-637f-6q2mLiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`
- Not ratedosv:GHSA-hhww-mrg2-969hLiteLLM vulnerable to reflected XSS in /sso/debug/callback
Other news entries
- Lessons from cybersecurity Black WeekNewsESET WeLiveSecurity
- LiteLLM supply chain attack started with an exposed master keyNewsThe Register — Security
- Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release PipelineNewsThe Hacker News
- LiteLLM: Schwachstelle ermöglicht Privilegieneskalation und CodeausführungVulnerabilityBSI CERT-Bund
- LiteLLM Compromised in Fresh Supply Chain AttackNewsSecurityWeek
- LiteLLM release pipeline hacked to distribute info-stealer malwareNewsBleepingComputer
- ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 MoreNewsThe Hacker News
- LiteLLM release pipeline hacked to distribute credential-stealing malwareNewsCSO Online
Source: https://thehackernews.com/2026/06/litellm-flaw-cve-2026-42271-exploited.html
ID