CVE-2026-42203
LiteLLM: Server-Side Template Injection in /prompts/test endpoint
Description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.80.5 to before version 1.83.7, the POST /prompts/test endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted template could run arbitrary code inside the LiteLLM Proxy process. The endpoint only checks that the caller presents a valid proxy API key, so any authenticated user could reach it. Depending on how the proxy is deployed, this could expose secrets in the process environment (such as provider API keys or database credentials) and allow commands to be run on the host. This issue has been patched in version 1.83.7.
INFO
Published Date :
May 8, 2026, 4:16 a.m.
Last Modified :
Oct. 26, 2026, 8:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Affected Products
The following products are affected by CVE-2026-42203
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | ||||
| CVSS 4.0 | HIGH | [email protected] |
Solution
- Update LiteLLM to version 1.83.7 or later.
- Restrict access to the /prompts/test endpoint.
- Review deployed secrets and credentials.
Public PoC/Exploit Available at Github
CVE-2026-42203 has a 3 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-42203.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-42203 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-42203
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
None
Python
Cathedral-Grade Security for AI Agents. Attack vectors updated daily. Local-first, zero API cost. MIT licensed.
Python
📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.
security cve exploit poc vulnerability
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-42203 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-42203 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 26, 2026
Action Type Old Value New Value Added Translation Title: litellm de BerriAI, Description: LiteLLM es un servidor proxy (Gateway de IA) para llamar a las API de LLM en formato OpenAI (o nativo). Desde la versión 1.80.5 hasta antes de la versión 1.83.7, el endpoint POST /prompts/test aceptaba plantillas de prompt proporcionadas por el usuario y las renderizaba sin sandboxing. Una plantilla manipulada podría ejecutar código arbitrario dentro del proceso del Proxy de LiteLLM. El endpoint solo verifica que el llamador presente una clave API de proxy válida, por lo que cualquier usuario autenticado podría alcanzarlo. Dependiendo de cómo se despliegue el proxy, esto podría exponer secretos en el entorno del proceso (como claves API de proveedor o credenciales de base de datos) y permitir que se ejecuten comandos en el host. Este problema ha sido parcheado en la versión 1.83.7. -
CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Jul. 15, 2026
Action Type Old Value New Value Changed Affected [{'cpes': ['cpe:/a:redhat:ansible_automation_platform:2'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:exploit_intelligence:0'], 'vendor': 'Red Hat', 'product': 'Exploit Intelligence', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:openshift_ai'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift AI (RHOAI)', 'defaultStatus': 'unaffected'}] [{'cpes': ['cpe:/a:redhat:exploit_intelligence:0'], 'vendor': 'Red Hat', 'product': 'Exploit Intelligence', 'packageName': 'exploit-intelligence-tech-preview/vulnerability-analysis-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:ansible_automation_platform:2'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2', 'packageName': 'ansible-automation-platform-26/lightspeed-chatbot-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_ai'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift AI (RHOAI)', 'packageName': 'rhoai/odh-llama-stack-core-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}] -
CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Jun. 30, 2026
Action Type Old Value New Value Added Affected [{'cpes': ['cpe:/a:redhat:ansible_automation_platform:2'], 'vendor': 'Red Hat', 'product': 'Red Hat Ansible Automation Platform 2', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:exploit_intelligence:0'], 'vendor': 'Red Hat', 'product': 'Exploit Intelligence', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:openshift_ai'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift AI (RHOAI)', 'defaultStatus': 'unaffected'}] Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-94 Added Reference https://access.redhat.com/security/cve/CVE-2026-42203 Added Reference https://bugzilla.redhat.com/show_bug.cgi?id=2467917 Added Reference https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42203.json -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-42203', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-05-08T00:00:00+00:00'} -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'BerriAI', 'product': 'litellm', 'versions': [{'status': 'affected', 'version': '>= 1.80.5, < 1.83.7'}]}] -
Initial Analysis by [email protected]
May. 13, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CPE Configuration OR *cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:* versions from (including) 1.80.5 up to (excluding) 1.83.7 Added Reference Type GitHub, Inc.: https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable Types: Product, Release Notes Added Reference Type GitHub, Inc.: https://github.com/BerriAI/litellm/security/advisories/GHSA-xqmj-j6mv-4862 Types: Mitigation, Patch, Vendor Advisory -
New CVE Received by [email protected]
May. 08, 2026
Action Type Old Value New Value Added Description LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.80.5 to before version 1.83.7, the POST /prompts/test endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted template could run arbitrary code inside the LiteLLM Proxy process. The endpoint only checks that the caller presents a valid proxy API key, so any authenticated user could reach it. Depending on how the proxy is deployed, this could expose secrets in the process environment (such as provider API keys or database credentials) and allow commands to be run on the host. This issue has been patched in version 1.83.7. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-1336 Added Reference https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable Added Reference https://github.com/BerriAI/litellm/security/advisories/GHSA-xqmj-j6mv-4862