CVE-2026-42271 (LiteLLM command injection) chained with CVE-2026-48710 (Starlette Host Header bypass) enables unauthenticated RCE on any exposed LiteLLM AI gateway instance, confirmed actively exploited in the wild. LiteLLM instances hold API keys and credentials for AI model providers including OpenAI and Anthropic; a compromised gateway exposes all proxied model credentials and conversation data.