Critical Unauthenticated RCE Vulnerability in LiteLLM Exploited in the Wild

A critical command-injection vulnerability in LiteLLM (CVE-2026-42271), when combined with a Host header validation bypass in Starlette (CVE-2026-48710), allows unauthenticated remote code execution; the flaw affects LiteLLM 1.74.2–1.83.6, is being actively exploited in the wild, was added to CISA's KEV on 2026-06-08, and mitigations include upgrading LiteLLM to 1.83.7 and Starlette to 1.0.1 and monitoring for anomalous Host headers and subprocess activity.