---
reference_key: horizon3-chain
title: "Horizon3.ai --- LiteLLM chained with Starlette BadHost RCE"
url: "https://horizon3.ai/attack-research/vulnerabilities/cve-2026-42271-chained-with-cve-2026-48710/"
availability: available
capture_method: primary
captured_at: 2026-06-23T03:31:09Z
document_id: REF-horizon3-chain
---

# Horizon3.ai --- LiteLLM chained with Starlette BadHost RCE

| Field | Value |
|-------|-------|
| **Reference key** | `horizon3-chain` |
| **Availability** | AVAILABLE |
| **Capture method** | `primary` |
| **Source type** | remote_url |
| **URL / path** | https://horizon3.ai/attack-research/vulnerabilities/cve-2026-42271-chained-with-cve-2026-48710/ |
| **Captured (UTC)** | 2026-06-23T03:31:09Z |
| **Content type** | text/html; charset=UTF-8 |
| **HTTP status** | 200 |

## Boardroom Citation Context

LiteLLM+Starlette chain; P7-05 tabletop.

## Source Location

https://horizon3.ai/attack-research/vulnerabilities/cve-2026-42271-chained-with-cve-2026-48710/





## Captured Content

```text
CVE-2026-42271: LiteLLM Unauthenticated RCE | Horizon3.ai Skip to main content Skip to footer New at Horizon3.ai Mythos has collapsed the attack path. | Learn how to prove your defenses now.  Solutions Autonomous Pentesting Internal Pentesting External Pentesting Kubernetes Pentesting Cloud Pentesting Active Directory Vulnerability Management Hub Threat Informed Perspectives Risk Based Vulnerability Management High-Value Targeting Advanced Data Pilfering Threat Actor Intelligence Vulnerability Risk Intelligence Security Control Validation Endpoint Security Effectiveness Identity Security Validation Data Security Effectiveness Threat Detection & Response Tripwires AD Tripwires Third-Party Risk Management CISA KEV Exploitation Rapid Response Platform The NodeZero Platform AI in Horizon3.ai MCP Server NodeZero for Compliance PCI Compliance NIS 2 Compliance Why Our Platform Wins Who Uses NodeZero? ITOps and SecOps Security Teams Pentesters Autonomously Solving Cyber Ranges NodeZero vs. GOAD Hack The Box (HTB) Attack Stories Industries NodeZero FederalTM Financial Services Healthcare US Public Sector NodeZero Packages Resources Attack Research Resource Center Events AI Infrastructure Security: Pentesting MCP & Agentic Systems June 19, 2026 | Blogs Autonomy Is Earned, Not Claimed June 17, 2026 | Blogs AI-Accelerated Exploitation: The Mythos-Era Threat Model June 13, 2026 | Blogs CVE-2026-48558: SimpleHelp Authentication Bypass Indicators of Compromise June 12, 2026 | Attack Blogs , Attack Research , Blogs , Disclosures Use Cases Education Manufacturing Supply Chain MSSP and MSP Company About Us Leadership Careers In the News Contact Us Partners Docs Log In Schedule a demo Solutions Autonomous Pentesting Internal Pentesting External Pentesting Kubernetes Pentesting Cloud Pentesting Active Directory Vulnerability Management Hub Threat Informed Perspectives Risk Based Vulnerability Management High-Value Targeting Advanced Data Pilfering Threat Actor Intelligence Vulnerability Risk Intelligence Security Control Validation Endpoint Security Effectiveness Identity Security Validation Data Security Effectiveness Threat Detection & Response Tripwires AD Tripwires Third-Party Risk Management CISA KEV Exploitation Rapid Response Platform The NodeZero Platform AI in Horizon3.ai MCP Server NodeZero for Compliance PCI Compliance NIS 2 Compliance Why Our Platform Wins Who Uses NodeZero? ITOps and SecOps Security Teams Pentesters Autonomously Solving Cyber Ranges NodeZero vs. GOAD Hack The Box (HTB) Attack Stories Industries NodeZero FederalTM Financial Services Healthcare US Public Sector NodeZero Packages Resources Attack Research Resource Center Events AI Infrastructure Security: Pentesting MCP & Agentic Systems June 19, 2026 | Blogs Autonomy Is Earned, Not Claimed June 17, 2026 | Blogs AI-Accelerated Exploitation: The Mythos-Era Threat Model June 13, 2026 | Blogs CVE-2026-48558: SimpleHelp Authentication Bypass Indicators of Compromise June 12, 2026 | Attack Blogs , Attack Research , Blogs , Disclosures Use Cases Education Manufacturing Supply Chain MSSP and MSP Company About Us Leadership Careers In the News Contact Us Partners Docs Log In Schedule a demo Solutions Autonomous Pentesting Internal Pentesting External Pentesting Kubernetes Pentesting Cloud Pentesting Active Directory Vulnerability Management Hub Threat Informed Perspectives CISA KEV Exploitation Rapid Response Risk Based Vulnerability Management High-Value Targeting Advanced Data Pilfering Threat Actor Intelligence Vulnerability Risk Intelligence Security Control Validation Endpoint Security Effectiveness Identity Security Validation Data Security Effectiveness Threat Detection & Response Tripwires AD Tripwires Platform The NodeZero Platform AI in Horizon3.ai MCP Server Autonomously Solving Cyber Ranges NodeZero vs. GOAD Hack The Box (HTB) Attack Stories Why Our Platform Wins Who Uses NodeZero? ITOps and SecOps Security Teams Pentesters NodeZero for Compliance PCI Compliance NIS 2 Compliance NodeZero Packages Resources Attack Research Resources Center Events Use Cases US Public Sector NodeZero Federal Education Healthcare Manufacturing Financial Services Supply Chain Large Organizations MSSP and MSP Company About Us Leadership Partners Careers In the News Contact Us Docs Schedule a Demo Log In CVE-2026-42271 Chained with CVE-2026-48710 LiteLLM Unauthenticated Remote Code Execution via Starlette Host Header Validation Bypass CVE-2026-42271 is a command injection vulnerability in LiteLLMs MCP server test endpoints that was originally disclosed as requiring authentication. Horizon3.ai researchers confirmed that when chained with CVE-2026-48710, a Starlette BadHost Host Header validation bypass vulnerability, the authentication requirement can be bypassed entirely. The result is unauthenticated remote code execution against vulnerable LiteLLM deployments, allowing attackers to execute commands as the LiteLLM proxy process. Affected LiteLLM versions include 1.74.2 through 1.83.6. Technical Details CVE-2026-42271 affects the following LiteLLM MCP server endpoints: POST /mcp-rest/test/connection POST /mcp-rest/test/tools/list These endpoints accept a complete server configuration, including command, arguments, and environment variables used by the stdio transport. When invoked, LiteLLM spawns the supplied command as a subprocess on the proxy host. The issue was originally considered authenticated because access was gated by a valid proxy API key. Horizon3.ai researchers validated that CVE-2026-48710 can be used to bypass the authentication mechanism entirely in LiteLLM deployments whose dependency tree includes Starlette versions <= 1.0.0. This transforms the vulnerability into unauthenticated remote code execution with no credentials required. Successful exploitation allows attackers to: Execute arbitrary commands on the LiteLLM host Access model provider credentials Steal API keys and secrets stored by the proxy Move laterally into connected AI infrastructure Compromise downstream systems integrated with the gateway The chained vulnerability has been assessed as CVSS 10.0 Critical.organizations relying on self-hosted Gitea environments. Stop Guessing, Start Proving Schedule a demo NodeZero Proactive Security Platform --- Rapid Response A NodeZero Rapid Response test has been developed to safely validate whether this chained authentication bypass and command injection vulnerability can be exploited in your environment. The test executes real attack techniques without causing damage, giving teams immediate clarity on exposure. Run the Rapid Response test: Launch from the NodeZero platform to determine whether unauthenticated command execution is possible Patch immediately: Upgrade LiteLLM to version 1.83.7 or later and ensure Starlette is upgraded to version 1.0.1 or later Re-run the test: Confirm the vulnerability chain is no longer exploitable after remediation Indicators of Compromise Indicator Type Description Unexpected subprocess execution Behavioral Commands spawned through LiteLLM MCP test endpoints Requests to /mcp-rest/test/connection HTTP Activity Suspicious use of testing functionality Requests to /mcp-rest/test/tools/list HTTP Activity Potential exploitation attempts Unusual Host header values Network Indicator Potential abuse of CVE-2026-48710 authentication bypass Unauthorized command execution Host Activity Evidence of successful exploitation and host compromise Affected Versions & Patch Affected LiteLLM versions 1.74.2 through 1.83.6 Deployments whose dependency tree includes Starlette <= 1.0.0 Patch Upgrade LiteLLM to version 1.83.7 or later Upgrade Starlette to version 1.0.1 or later If immediate patching is not possible: Block access to the affected MCP test endpoints Restrict network access to trusted segments Rotate credentials stored by the proxy Review logs for unusual Host header activity and subprocess execution events Timeline April 20, 2026  CVE-2026-42271 was disclosed as a command injection vulnerability affecting LiteLLM MCP test endpoints. May 8, 2026  LiteLLM published fixes in version 1.83.7, introducing additional authorization controls and updated Starlette dependencies. May 26, 2026  Public disclosure of CVE-2026-48710 (BadHost) detailed Host header validation bypasses affecting Starlette-based applications. June, 1, 2026  Horizon3.ai researchers validated the chained exploitation path and confirmed unauthenticated remote code execution against affected LiteLLM deployments. References Starlette Advisory LiteLLM Advisory CVE-2026-42271 CVE-2026-48710 OSTIF BadHost Disclosure Read about other CVEs CVE-2026-50751 CVE-2026-50751 is an authentication bypass vulnerability affecting Check Point Security Gateway VPN services. Check Point has confirmed active exploitation against... Read more CVE-2026-20253 CVE-2026-20253 is a critical unauthenticated arbitrary file write vulnerability affecting Splunk Enterprise. The flaw may allow attackers to create or... Read more CVE-2026-48558 CVE-2026-48558 is an authentication bypass vulnerability affecting SimpleHelp OIDC deployments. The flaw may allow attackers to create unauthorized Technician accounts... Read more NodeZero  Platform Implement a continuous find, fix, and verify loop with NodeZero The NodeZero  platform empowers your organization to reduce your security risks by autonomously finding exploitable weaknesses in your network, giving you detailed guidance around how to priortize and fix them, and having you immediately verify that your fixes are effective. Explore NodeZero Recognized By Horizon3.ai NodeZero Achieves Awardable Status in the Tradewinds Solutions Marketplace Fast Companys Worlds Most Innovative Companies of 2026 Deloitte Technology Fast 500 Award 2025 Black Unicorn Awards 2025 2025 Inc. 5000  #1 in Security Best AI-Powered Red Teaming Solution  San Francisco 2025 Best SaaS Product for Cybersecurity 2025 2025 AI in Cybersecurity Innovation Award IT-Harvest Fast Growth Vendor Award 2026 The Channel Co. MES Computing 2025 Connect with Us NodeZero Solution NodeZero Overview Internal Pentesting Kubernetes Pentesting External Pentesting Cloud Pentesting NodeZero Insights Rapid Response AD Password Audit Phishing Impact Testing NodeZero Tripwires Pentesting for Compliance Pentesting for PCI Compliance Pentesting for NIS 2 Compliance Resources Blog Attack Research White Papers Fact Sheets Case Studies Testimonials NodeZero Documentation Use Cases Education Healthcare Manufacturing Public Sector Supply Chain Financial Services Large Organization MSSPs and MSPs DIB Suppliers Roles ITOps and SecOps Security Teams Consulting Pentester Partners MSSPs and MSPs Become a Partner Partner Portal On AWS Marketplace Company About Us Careers Press Awards Contact Upcoming Events  2026 All Rights Reserved. Privacy Policy Support Policy Terms of Service Change Cookie Preferences Trust Center Website Terms 
```

---

*Archived reference article for AICSR-STUDY-2026-001 footnote corpus.*