BerriAI LiteLLM Command Injection Vulnerability. 悪用が確認されています：CISA は 08/06/2026 にこの脆弱性を「既知の悪用された脆弱性（KEV）」カタログに追加しました。影響を受けるシステムは緊急に修正してください。
| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| litellm | ≥ 1.74.2, < 1.83.7 | 1.83.7 |
| litellm | ≥ 1.74.2, < 1.83.7 | 1.83.7 |
| openshift ai | = 3.4≥ 2.25, < 2.25.8≥ 3.3, < 3.3.4 | 2.25.83.3.4 |
Two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process.
The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host.
Fixed in 1.83.7. Both test endpoints now require the PROXY_ADMIN role, bringing them into line with the save endpoint.
If upgrading is not immediately possible, developers should block POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list at their reverse proxy or API gateway.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン