[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":57,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":64,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":70,"vulnerability-29946":77},[4,13,23,35,43,50],{"title":5,"slug":6,"text":7,"link":8,"external":9,"targets":10,"cta":8,"variant":12,"priority":12,"campaign_id":6},"PHP2Shell, Node2Shell, *sshole detections - pricing page","node2shell-exploit","Detect PHP2Shell, Node2Shell & *sshole with every paid plan.",null,false,[11],"\u002Fpricing","secondary",{"title":14,"slug":15,"text":16,"link":17,"external":18,"targets":19,"cta":22,"variant":12,"priority":12,"campaign_id":15},"Office Hours #15","office-hours-15","[Live Office Hours, Wed Nov 18] Behind the login, beyond the scan","https:\u002F\u002Fzoom.us\u002Fwebinar\u002Fregister\u002F5117815316917\u002FWN_BUp1qET2THa_5h65whpx9g",true,[20,21],"\u002Fwebinars\u002Foffice-hours","\u002Fwebinars","Save your spot",{"title":24,"slug":25,"text":26,"link":27,"external":9,"targets":28,"cta":34,"variant":12,"priority":12,"campaign_id":25},"*sshole, PHP2Shell & Node2Shell - HP, Vuln DB, product page","sshole-detect-exploit","🚨 Detect *sshole & Node2Shell with any paid plan. Get proof with our Sniper exploit","https:\u002F\u002Fpentest-tools.com\u002Fpricing",[29,30,31,32,33],"\u002F","\u002Fvulnerabilities-exploits","\u002Fvulnerabilities-exploits\u002Fopenssh-musl-authentication-bypass-cve-2026-123158-sshole_29981","\u002Fvulnerabilities-exploits\u002Fnode2shell-http2shell-brotli-decoder-remote-code-execution_29896","\u002Fproduct","See pricing options",{"title":36,"slug":37,"text":38,"link":27,"external":9,"targets":39,"cta":41,"variant":12,"priority":12,"campaign_id":42},"*sshole - Exploit on Sniper: Auto-Exploiter page","sshole-exploit-sniper","🚨 Exclusive exploit for *sshole now live",[40],"\u002Fexploit-helpers\u002Fsniper","Use it with the Exploit plan","sshole-exploit",{"title":44,"slug":45,"text":46,"link":27,"external":18,"targets":47,"cta":49,"variant":12,"priority":12,"campaign_id":42},"*sshole exploit - Exploit on the NS page","sshole-exploit-ns","🚨 Go beyond *sshole detection: get proof of exploitation",[48],"\u002Fnetwork-vulnerability-scanning\u002Fnetwork-security-scanner-online","Pick the Exploit plan",{"title":51,"slug":52,"text":53,"link":27,"external":18,"targets":54,"cta":34,"variant":12,"priority":12,"campaign_id":42},"*sshole exploit - WS, free tools","sshole-exploit-mainpw","Detect *sshole with every paid plan. Prove it with Exploit.",[55,56],"\u002Fwebsite-vulnerability-scanning\u002Fwebsite-scanner","\u002Ffor\u002Ffree",["Island",58],{"key":59,"params":60,"result":62},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":61},"{}",{"head":63},{},["Island",65],{"key":66,"params":67,"result":68},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":61},{"head":69},{},["Island",71],{"key":72,"params":73,"result":75},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":74},"{\"text-color\":\"gray\"}",{"head":76},{},{"id":78,"detectable_with":79,"vuln_details":85,"vuln_id":108,"name":109,"published":110,"updated":110},29946,{"tool":80,"engine":83},{"id":81,"name":82},1,"Network Scanner",{"id":81,"name":84},"Sniper",{"id":78,"codename":8,"description":86,"severity":87,"risk_description":88,"public_description":89,"public_recommendation":90,"recommendation":91,"references":92,"cvssv3":97,"epss_score":98,"epss_percentile":99,"cve":100,"in_cisa_catalog":18,"date":102,"software_type":103,"vendor":104,"product":105,"ptt_exploit_capabilities":106},"We found that the target server is vulnerable to CVE-2026-42271, a Remote Code Execution vulnerability affecting LiteLLM versions 1.74.2 through 1.83.6. The two MCP preview endpoints \u003Ccode>POST \u002Fmcp-rest\u002Ftest\u002Fconnection\u003C\u002Fcode> and \u003Ccode>POST \u002Fmcp-rest\u002Ftest\u002Ftools\u002Flist\u003C\u002Fcode> accept a full MCP stdio configuration in the request body (including the \u003Ccode>command\u003C\u002Fcode>, \u003Ccode>args\u003C\u002Fcode> and \u003Ccode>env\u003C\u002Fcode> fields) and spawn the supplied command as a subprocess on the proxy host when the transport is set to \u003Ccode>stdio\u003C\u002Fcode>. The endpoints only require a valid proxy API key and perform no role check, and in the default Docker image the proxy process runs as root. Chained with the Starlette host-header authentication bypass (CVE-2026-48710), the request can be sent without any API key, allowing an unauthenticated attacker to execute arbitrary commands as root. \nWe have detected this vulnerability by sending a crafted request with a malformed Host header and an MCP stdio payload that runs the \u003Ccode>id\u003C\u002Fcode> command, and reading the command output back over an out-of-band handler.","critical","The risk exists that a remote unauthenticated attacker can fully compromise the server in order to steal confidential information, install ransomware, or pivot to the internal network.","LiteLLM is affected by a Remote Code Execution vulnerability located in the MCP stdio preview endpoints. These endpoints accept a full server configuration, including the command and arguments used by the stdio transport, and spawn the supplied command as a subprocess on the proxy host. The endpoints perform no role check and, when chained with the Starlette host-header authentication bypass (CVE-2026-48710), an unauthenticated remote attacker can execute arbitrary commands with the privileges of the LiteLLM process, which runs as root in the default Docker image.","Upgrade LiteLLM to version 1.83.7 or later.","We recommend to upgrade LiteLLM to version 1.83.7 or later. If immediate patching is not possible, restrict access to the MCP preview endpoints and enforce strict role-based access controls for API keys.",[93,94,95,96],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42271","https:\u002F\u002Fgithub.com\u002FBerriAI\u002Flitellm\u002Fsecurity\u002Fadvisories\u002FGHSA-v4p8-mg3p-g94g","https:\u002F\u002Fhorizon3.ai\u002Fattack-research\u002Fvulnerabilities\u002Fcve-2026-42271-chained-with-cve-2026-48710\u002F","https:\u002F\u002Fgithub.com\u002FBerriAI\u002Flitellm\u002Fpull\u002F25343",9.8,0.91445,0.99814,[101],"CVE-2026-42271","2026-05-08T00:00:00Z","AI Gateway","BerriAI","LiteLLM",[107],"RCE","NETSCAN-SNIPER-CVE-2026-42271","LiteLLM - Remote Code Execution","2026-10-26T00:00:00Z"]