LiteLLM versions prior to 1.95.0 contain a vulnerability allowing an authenticated user with internal_user_viewer privileges to read arbitrary local files via a crafted vertex_ai_credentials value. This occurs because the request-body safety blocklist missed the alias vertex_ai_credentials, enabling file read access that can disclose sensitive environment variables and escalate privileges. The issue is fixed in version 1.95.0.
LiteLLM versions from 1.65.5 up to but not including 1.85.0 contain a reflected cross-site scripting (XSS) vulnerability in the /sso/debug/callback endpoint. This endpoint reflects identity-provider-controlled fields into an inline script block without properly escaping HTML context characters, allowing an attacker to inject malicious JavaScript. The vulnerability can be exploited by an attacker with an account on the configured identity provider to execute scripts in the proxy origin, potentially leading to full admin account takeover.
An authenticated user with internal_user privileges in LiteLLM can escalate to proxy_admin and execute arbitrary commands on the host. The vulnerability arises because the proxy uses the same encryption key for sealing secrets and minting session tokens, allowing an attacker to forge admin credentials via a crafted API key request. Versions >=1.91.0 and certain earlier versions with EXPERIMENTAL_UI_LOGIN=true are affected. Patches are available in versions 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0rc2. Mitigation includes upgrading to a fixed version or disabling EXPERIMENTAL_UI_LOGIN as a temporary workaround.
CVE-2026-108575 is a medium severity vulnerability in BerriAI LiteLLM up to version 1.94.0. It involves improper authorization in the get_secret function of the Secret Resolution component, specifically in secret_managers/main.py. The vulnerability arises from manipulation of the api_key argument, allowing remote attackers to bypass authorization controls. The issue has been publicly disclosed, but the vendor has not responded or provided a fix.
CVE-2026-108574 is an authorization bypass vulnerability in BerriAI LiteLLM versions up to 1.95.0. The flaw exists in the ui_view_session_spend_logs function of the Spend Tracking component, where manipulation of the session_id argument can bypass authorization checks. This vulnerability can be exploited remotely. An exploit has been published. Upgrading to version 1.96.0 resolves the issue.
A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this issue is the function ui_view_users of the file litellm/proxy/management_endpoints/internal_user_endpoints.py of the component Incomplete Fix CVE-2025-0628. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
A security flaw has been discovered in BerriAI litellm up to 1.82.5. Affected is the function async_pre_call_hook of the file enterprise/enterprise_hooks/banned_keywords.py of the component Completions Interface. The manipulation of the argument prompt results in incorrect authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.
A vulnerability was identified in BerriAI litellm up to 1.82.2. This impacts the function get_redirect_response_from_openid of the file litellm/proxy/management_endpoints/ui_sso.py of the component SSO Authentication Flow. The manipulation leads to session expiration. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
A vulnerability was determined in BerriAI litellm up to 1.82.2. This affects the function json.dumps of the file litellm/proxy/management_endpoints/ui_sso.py of the component SSO Debug Flow. Executing a manipulation can lead to missing authentication. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function _execute_with_mcp_client of the file litellm/proxy/_experimental/mcp_server/rest_endpoints.py of the component MCP Server Connection Testing. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
A security flaw has been discovered in BerriAI litellm up to 1.82.2. This impacts the function authenticate_user of the file litellm/proxy/auth/login_utils.py of the component PROXY_ADMIN database API Key Generator. Performing a manipulation results in session expiration. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.
A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/user_api_key_auth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py of the component MCP Proxy. Executing a manipulation can lead to improper authentication. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
A vulnerability was determined in BerriAI litellm up to 1.63.1. The impacted element is an unknown function of the file litellm/proxy/management_endpoints/key_management_endpoints.py of the component Admin Key Handler. This manipulation causes improper authorization. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 23781. It is recommended to apply a patch to fix this issue. The vendor was contacted early about this disclosure.
LiteLLM versions from 1.81.8 up to but not including 1.83.10 contain a sandbox escape vulnerability in the custom-code guardrail feature. The POST /guardrails/test_custom_code endpoint executes user-supplied Python code inside a custom sandbox that can be bypassed using bytecode-level techniques, allowing arbitrary code execution as root in the default Docker setup. Access to this endpoint requires proxy-admin credentials by default. The issue is fixed in version 1.83.10 by replacing the custom sandbox with RestrictedPython.
LiteLLM versions prior to 1.83.0 contain a privilege escalation vulnerability in the /config/update endpoint, which lacks proper admin role authorization. Authenticated users can exploit this to modify proxy settings, execute arbitrary Python code remotely, read arbitrary server files, and take over privileged accounts by overwriting environment variables. The issue is fixed in version 1.83.0 by requiring the proxy_admin role for this endpoint. No configuration-level workaround exists; restricting API key distribution is recommended until patched.
The litellm Python package versions 1.82.7, 1.82.8, and 1.107.0 distributed via PyPI contain malicious code injected during build or upload. This code includes a credential stealer that collects a wide range of sensitive data such as browser passwords, cloud credentials, SSH keys, and developer tool configurations, encrypts it, and exfiltrates it to an attacker-controlled server. Additionally, a backdoor is installed that fetches and executes remote code periodically, enabling remote code execution. Versions 1.106.2 and 1.107.0 release candidates are not affected. Any environment with version 1.107.0 installed should be considered compromised and credentials rotated.
BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint. The vulnerability arises from the `hf_chat_template` method processing the `chat_template` parameter from the `tokenizer_config.json` file through the Jinja template engine without proper sanitization. Attackers can exploit this by crafting malicious `tokenizer_config.json` files that execute arbitrary code on the server.