# CISA flags LiteLLM and Check Point flaws

Published: 2026-06-08 · Severity: high · Sectors: government-national
Canonical: https://vorant.io/reports/27aaf8f8-e03c-470f-9be2-4d888de8a52a/cisa-flags-litellm-and-check-point-flaws

> CISA added two actively exploited vulnerabilities to its KEV Catalog: a command injection flaw in BerriAI LiteLLM and an authentication bypass in Check Point Security Gateway.

The Cybersecurity and Infrastructure Security Agency has cataloged two new vulnerabilities under active exploitation, requiring federal agencies to prioritize remediation. CVE-2026-42271 affects BerriAI LiteLLM and permits command injection, while CVE-2026-50751 is an authentication weakness in Check Point Security Gateway products.

Inclusion in the Known Exploited Vulnerabilities Catalog signals confirmed in-the-wild abuse by threat actors. Under Binding Operational Directive 22-01, Federal Civilian Executive Branch agencies must remediate these flaws by specified deadlines. CISA recommends all organizations treat KEV listings as high-priority patching targets regardless of sector.

The addition of these vulnerabilities reflects ongoing attacker interest in both AI infrastructure components and network security appliances. Organizations running affected products should validate exposure and apply vendor patches immediately.

## Mentioned in this report

- Vulnerabilities: CVE-2026-42271 (KEV), CVE-2026-50751 (KEV)

## Detection guidance (public sample)

### Suspicious Child Process Spawned by LiteLLM Service (Possible Command Injection)

ATT&CK: T1059

Detects a shell or system command spawned from a Python/uvicorn/gunicorn process consistent with LiteLLM, indicating possible exploitation of a command injection vulnerability (e.g., CVE-2026-42271). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process from LiteLLM/Python Web Service
id: 6ee7c1e2-5990-5159-89bc-e39386f996cf
status: experimental
description: 'Detects command/shell interpreters spawned as children of Python-based
  web service processes (e.g., uvicorn, gunicorn) commonly used to run LiteLLM.

  This pattern is consistent with exploitation of command injection vulnerabilities
  such as CVE-2026-42271 in BerriAI LiteLLM, where an attacker-supplied

  input is passed unsanitized to a shell execution function, causing the application
  process to spawn an unexpected system shell.

  '
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - python
    - python3
    - uvicorn
    - gunicorn
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /ash
  filter_known_admin:
    CommandLine|contains:
    - healthcheck
    - pytest
  condition: selection_parent and selection_child and not filter_known_admin
falsepositives:
- Legitimate application startup scripts or health-check wrappers that shell out from
  the Python web process
- CI/CD pipelines running tests against a LiteLLM instance that spawn shell subprocesses
- Administrative debugging sessions attached to the LiteLLM service container
level: medium
tags:
- attack.t1059
- attack.initial_access
- cve.2026-42271
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/alerts/2026/06/08/cisa-adds-two-known-exploited-vulnerabilities-catalog

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/27aaf8f8-e03c-470f-9be2-4d888de8a52a/cisa-flags-litellm-and-check-point-flaws.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup