CISA flags LiteLLM and Check Point flaws
CISA added two actively exploited vulnerabilities to its KEV Catalog: a command injection flaw in BerriAI LiteLLM and an authentication bypass in Check Point Security Gateway.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-42271 and CVE-2026-50751 as exploited in the wild.
The Cybersecurity and Infrastructure Security Agency has cataloged two new vulnerabilities under active exploitation, requiring federal agencies to prioritize remediation. CVE-2026-42271 affects BerriAI LiteLLM and permits command injection, while CVE-2026-50751 is an authentication weakness in Check Point Security Gateway products.
Inclusion in the Known Exploited Vulnerabilities Catalog signals confirmed in-the-wild abuse by threat actors. Under Binding Operational Directive 22-01, Federal Civilian Executive Branch agencies must remediate these flaws by specified deadlines. CISA recommends all organizations treat KEV listings as high-priority patching targets regardless of sector.
The addition of these vulnerabilities reflects ongoing attacker interest in both AI infrastructure components and network security appliances. Organizations running affected products should validate exposure and apply vendor patches immediately.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by LiteLLM Service (Possible Command Injection)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a shell or system command spawned from a Python/uvicorn/gunicorn process consistent with LiteLLM, indicating possible exploitation of a command injection vulnerability (e.g., CVE-2026-42271). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process from LiteLLM/Python Web Service
id: 6ee7c1e2-5990-5159-89bc-e39386f996cf
status: experimental
description: 'Detects command/shell interpreters spawned as children of Python-based
web service processes (e.g., uvicorn, gunicorn) commonly used to run LiteLLM.
This pattern is consistent with exploitation of command injection vulnerabilities
such as CVE-2026-42271 in BerriAI LiteLLM, where an attacker-supplied
input is passed unsanitized to a shell execution function, causing the application
process to spawn an unexpected system shell.
'
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- python
- python3
- uvicorn
- gunicorn
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /ash
filter_known_admin:
CommandLine|contains:
- healthcheck
- pytest
condition: selection_parent and selection_child and not filter_known_admin
falsepositives:
- Legitimate application startup scripts or health-check wrappers that shell out from
the Python web process
- CI/CD pipelines running tests against a LiteLLM instance that spawn shell subprocesses
- Administrative debugging sessions attached to the LiteLLM service container
level: medium
tags:
- attack.t1059
- attack.initial-access
- cve.2026-42271
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/alerts/2026/06/08/cisa-adds-two-known-exploited-vulnerabilities-catalog
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs