[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
litellm	1.81.14 → 1.109.0
litellm	1.81.13 → 1.109.0

---

LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint

CVE-2026-35029 / GHSA-53mr-6c8q-9789

More information

Details

Impact

The /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to do the following:

• Modify proxy configuration and environment variables
• Register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution
• Read arbitrary server files by setting UI_LOGO_PATH and fetching via /get_image
• Take over other priveleged accounts by overwriting UI_USERNAME and UI_PASSWORD environment variables

Patches

Fixed in v1.83.0. The endpoint now requires proxy_admin role.

Workarounds

Restrict API key distribution. There is no configuration-level workaround.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N

References

• https://github.com/BerriAI/litellm/security/advisories/GHSA-53mr-6c8q-9789
• https://nvd.nist.gov/vuln/detail/CVE-2026-35029
• http://seclists.org/fulldisclosure/2026/Apr/17
• https://github.com/advisories/GHSA-53mr-6c8q-9789

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

LiteLLM: Authentication bypass via OIDC userinfo cache key collision

CVE-2026-35030 / GHSA-jjhc-v7c2-5hh6

More information

Details

Impact

When JWT authentication is enabled (enable_jwt_auth: true), the OIDC userinfo cache uses token[:20] as the cache key. JWT headers produced by the same signing algorithm generate identical first 20 characters.

This configuration option is not enabled by default. Most instances are not affected.

An unauthenticated attacker can craft a token whose first 20 characters match a legitimate user's cached token. On cache hit, the attacker inherits the legitimate user's identity and permissions. This affects deployments with JWT/OIDC authentication enabled.

Patches

Fixed in v1.83.0. The cache key now uses the full hash of the JWT token.

Workarounds

Disable OIDC userinfo caching by setting the cache TTL to 0, or disable JWT authentication entirely.

Severity

• CVSS Score: 9.4 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

References

• https://github.com/BerriAI/litellm/security/advisories/GHSA-jjhc-v7c2-5hh6
• https://nvd.nist.gov/vuln/detail/CVE-2026-35030
• https://github.com/advisories/GHSA-jjhc-v7c2-5hh6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

LiteLLM: Password hash exposure and pass-the-hash authentication bypass

GHSA-69x8-hrgq-fjj8

More information

Details

Impact

Three issues combine into a full authentication bypass chain:

1. Weak hashing: User passwords are stored as unsalted SHA-256 hashes, making them vulnerable to rainbow table attacks and trivially identifying users with identical passwords.
2. Hash exposure: Multiple API endpoints (/user/info, /user/update, /spend/users) return the password hash field in responses to any authenticated user regardless of role. Plaintext passwords could also potentially be exposed in certain scenarios.
3. Pass-the-hash: The /v2/login endpoint accepts the raw SHA-256 hash as a valid password without re-hashing, allowing direct login with a stolen

An already authenticated user can retrieve another user's password hash from the API and use it to log in as that user. This enables full privilege escalation in three HTTP requests.

Patches

Fixed in v1.83.0. Passwords are now hashed with scrypt (random 16-byte salt, n=16384, r=8, p=1). Password hashes are stripped from all API responses. Existing SHA-256 hashes are transparently migrated on next login.

Severity

• CVSS Score: 8.6 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/BerriAI/litellm/security/advisories/GHSA-69x8-hrgq-fjj8
• https://github.com/advisories/GHSA-69x8-hrgq-fjj8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

LiteLLM: Server-Side Template Injection in /prompts/test endpoint

CVE-2026-42203 / GHSA-xqmj-j6mv-4862

More information

Details

Impact

The POST /prompts/test endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted template could run arbitrary code inside the LiteLLM Proxy process.

The endpoint only checks that the caller presents a valid proxy API key, so any authenticated user could reach it. Depending on how the proxy is deployed, this could expose secrets in the process environment (such as provider API keys or database credentials) and allow commands to be run on the host.

Proxy deployments running an affected version are in scope.

Patches

The issue is fixed in 1.83.7-stable. The fix switches the prompt template renderer to a sandboxed environment that blocks the attributes this attack relies on.

LiteLLM recommends upgrading to 1.83.7-stable or later.

Workarounds

If upgrading is not immediately possible:

1. Block POST /prompts/test at your reverse proxy or API gateway.
2. Review and rotate API keys that should not have access to prompt management routes.

Severity

• CVSS Score: 8.6 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/BerriAI/litellm/security/advisories/GHSA-xqmj-j6mv-4862
• https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable
• https://nvd.nist.gov/vuln/detail/CVE-2026-42203
• https://github.com/advisories/GHSA-xqmj-j6mv-4862

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

LiteLLM: Authenticated command execution via MCP stdio test endpoints

CVE-2026-42271 / GHSA-v4p8-mg3p-g94g

More information

Details

Impact

Two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process.

The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host.

Patches

Fixed in 1.83.7. Both test endpoints now require the PROXY_ADMIN role, bringing them into line with the save endpoint.

Workarounds

If upgrading is not immediately possible, developers should block POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list at their reverse proxy or API gateway.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N

References

• https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g
• https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable
• https://nvd.nist.gov/vuln/detail/CVE-2026-42271
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42271
• https://github.com/advisories/GHSA-v4p8-mg3p-g94g

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

LiteLLM has a sandbox escape in custom-code guardrail

CVE-2026-40217 / GHSA-wxxx-gvqv-xp7p

More information

Details

Impact

The POST /guardrails/test_custom_code endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process — which runs as root in the default Docker image.

Reaching the endpoint requires a proxy-admin credential in default configurations.

Patches

Fixed in 1.83.11. The hand-rolled sandbox has been replaced with RestrictedPython. Upgrade to 1.83.11 or later.

Workarounds

If upgrading is not immediately possible, block POST /guardrails/test_custom_code at your reverse proxy or API gateway.

References

• Patched release: v1.83.10-stable

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/BerriAI/litellm/security/advisories/GHSA-wxxx-gvqv-xp7p
• https://nvd.nist.gov/vuln/detail/CVE-2026-40217
• https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable
• https://www.x41-dsec.de/lab/advisories/x41-2026-001-litellm
• https://github.com/advisories/GHSA-wxxx-gvqv-xp7p

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks

CVE-2026-59821 / GHSA-72m8-9m7m-h278 / PYSEC-2026-3478

More information

Details

Impact

LiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and validation used by the test endpoint.

A privileged user with access to create or update guardrails could submit custom Python code that executed in the LiteLLM proxy environment. In deployments without a configured master key, callers could be treated as proxy administrators, making this reachable without intended administrative authorization.

This could allow arbitrary code execution in the LiteLLM proxy container and exposure of secrets available to the process.

Patches

The issue is fixed in 1.82.0-stable.

LiteLLM recommend upgrading to 1.82.0-stable or later.

Workarounds

If upgrading is not immediately possible:

1. Restrict access to POST /guardrails and PUT /guardrails/{guardrail_id} to trusted administrators only.
2. Ensure LITELLM_MASTER_KEY is configured.
3. Avoid enabling Custom Code Guardrails for untrusted users.

Severity

• CVSS Score: 2.1 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/BerriAI/litellm/security/advisories/GHSA-72m8-9m7m-h278
• https://nvd.nist.gov/vuln/detail/CVE-2026-59821
• https://github.com/BerriAI/litellm/commit/e50b4486d0f7aa0497185a1ebcdd2c91f1769eba
• https://github.com/BerriAI/litellm
• https://github.com/BerriAI/litellm/releases/tag/v1.82.0-stable

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks

CVE-2026-59821 / GHSA-72m8-9m7m-h278 / PYSEC-2026-3478

More information

Details

Impact

LiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and validation used by the test endpoint.

A privileged user with access to create or update guardrails could submit custom Python code that executed in the LiteLLM proxy environment. In deployments without a configured master key, callers could be treated as proxy administrators, making this reachable without intended administrative authorization.

This could allow arbitrary code execution in the LiteLLM proxy container and exposure of secrets available to the process.

Patches

The issue is fixed in 1.82.0-stable.

LiteLLM recommend upgrading to 1.82.0-stable or later.

Workarounds

If upgrading is not immediately possible:

1. Restrict access to POST /guardrails and PUT /guardrails/{guardrail_id} to trusted administrators only.
2. Ensure LITELLM_MASTER_KEY is configured.
3. Avoid enabling Custom Code Guardrails for untrusted users.

Severity

• CVSS Score: 2.1 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/BerriAI/litellm/security/advisories/GHSA-72m8-9m7m-h278
• https://nvd.nist.gov/vuln/detail/CVE-2026-59821
• https://github.com/BerriAI/litellm/commit/e50b4486d0f7aa0497185a1ebcdd2c91f1769eba
• https://github.com/BerriAI/litellm
• https://github.com/BerriAI/litellm/releases/tag/v1.82.0-stable
• https://pypi.org/project/litellm
• https://github.com/advisories/GHSA-72m8-9m7m-h278

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

---

BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader

CVE-2026-12798 / GHSA-c693-x898-5g4h / PYSEC-2026-4069

More information

Details

A weakness has been identified in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function load_openapi_spec_async of the file litellm/proxy/_experimental/mcp_server/openapi_to_mcp_generator.py of the component MCP OpenAPI Spec Loader. This manipulation of the argument spec_path causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

Severity

• CVSS Score: 2.1 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-12798
• https://gist.github.com/YLChen-007/c1104c529975699ba347feedfbe02c5a
• https://github.com/BerriAI/litellm
• https://vuldb.com/cve/CVE-2026-12798
• https://vuldb.com/submit/811290
• https://vuldb.com/vuln/372560
• https://vuldb.com/vuln/372560/cti

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

LiteLLM: SSO Debug Flow Has Improper Authentication

CVE-2026-12795 / GHSA-j37q-q7p9-vpwm / PYSEC-2026-4071

More information

Details

A vulnerability was determined in BerriAI litellm up to 1.82.2. This affects the function json.dumps of the file litellm/proxy/management_endpoints/ui_sso.py of the component SSO Debug Flow. Executing a manipulation can lead to missing authentication. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

Severity

• CVSS Score: 5.5 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-12795
• https://gist.github.com/YLChen-007/9b13c75a3a73187a4082cc6df0b100d3
• https://github.com/BerriAI/litellm
• https://vuldb.com/cve/CVE-2026-12795
• https://vuldb.com/submit/811286
• https://vuldb.com/vuln/372557
• https://vuldb.com/vuln/372557/cti

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure

CVE-2026-12799 / GHSA-m2v5-74w2-qhcj / PYSEC-2026-4072

More information

Details

A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this issue is the function ui_view_users of the file litellm/proxy/management_endpoints/internal_user_endpoints.py of the component Incomplete Fix CVE-2025-0628. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

Severity

• CVSS Score: 2.1 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-12799
• https://gist.github.com/YLChen-007/3ace22e33e468d0166fe609c9fdf4184
• https://github.com/BerriAI/litellm
• https://vuldb.com/cve/CVE-2026-12799
• https://vuldb.com/submit/811291
• https://vuldb.com/vuln/372561
• https://vuldb.com/vuln/372561/cti

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration

CVE-2026-12772 / GHSA-mf52-j94g-746m / PYSEC-2026-4073

More information

Details

A security flaw has been discovered in BerriAI litellm up to 1.82.2. This impacts the function authenticate_user of the file litellm/proxy/auth/login_utils.py of the component PROXY_ADMIN database API Key Generator. Performing a manipulation results in session expiration. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.

Severity

• CVSS Score: 2.1 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-12772
• https://gist.github.com/YLChen-007/39ed709ce322431658a05b951e91f278
• https://github.com/BerriAI/litellm
• https://vuldb.com/cve/CVE-2026-12772
• https://vuldb.com/submit/811281
• https://vuldb.com/vuln/372514
• https://vuldb.com/vuln/372514/cti

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

LiteLLM: M2M JWT Handler Has Improper Authorization

CVE-2026-12771 / GHSA-qmf3-4767-5fg3 / PYSEC-2026-4075

More information

Details

A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/user_api_key_auth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

Severity

• CVSS Score: 1.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-12771
• https://gist.github.com/YLChen-007/70e4e106527f74ddf17953ff0f6c248d
• https://github.com/BerriAI/litellm
• https://vuldb.com/cve/CVE-2026-12771
• https://vuldb.com/submit/811280
• https://vuldb.com/vuln/372513
• https://vuldb.com/vuln/372513/cti

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens

CVE-2026-12796 / GHSA-w2mh-qq9q-453x / PYSEC-2026-4076

More information

Details

A vulnerability was identified in BerriAI litellm up to 1.82.2. This impacts the function get_redirect_response_from_openid of the file litellm/proxy/management_endpoints/ui_sso.py of the component SSO Authentication Flow. The manipulation leads to session expiration. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

Severity

• CVSS Score: 2.1 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-12796
• https://gist.github.com/YLChen-007/5fa8af12e1b183674d7ca96d852fb697
• https://github.com/BerriAI/litellm
• https://vuldb.com/cve/CVE-2026-12796
• https://vuldb.com/submit/811287
• https://vuldb.com/vuln/372558
• https://vuldb.com/vuln/372558/cti

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader

CVE-2026-12798 / GHSA-c693-x898-5g4h / PYSEC-2026-4069

More information

Details

A weakness has been identified in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function load_openapi_spec_async of the file litellm/proxy/_experimental/mcp_server/openapi_to_mcp_generator.py of the component MCP OpenAPI Spec Loader. This manipulation of the argument spec_path causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

Severity

• CVSS Score: 2.1 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-12798
• https://gist.github.com/YLChen-007/c1104c529975699ba347feedfbe02c5a
• https://github.com/BerriAI/litellm
• https://vuldb.com/cve/CVE-2026-12798
• https://vuldb.com/submit/811290
• https://vuldb.com/vuln/372560
• https://vuldb.com/vuln/372560/cti
• https://pypi.org/project/litellm
• https://github.com/advisories/GHSA-c693-x898-5g4h

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

---

LiteLLM: SSO Debug Flow Has Improper Authentication

CVE-2026-12795 / GHSA-j37q-q7p9-vpwm / PYSEC-2026-4071

More information

Details

A vulnerability was determined in BerriAI litellm up to 1.82.2. This affects the function json.dumps of the file litellm/proxy/management_endpoints/ui_sso.py of the component SSO Debug Flow. Executing a manipulation can lead to missing authentication. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

Severity

• CVSS Score: 5.5 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-12795
• https://gist.github.com/YLChen-007/9b13c75a3a73187a4082cc6df0b100d3
• https://github.com/BerriAI/litellm
• https://vuldb.com/cve/CVE-2026-12795
• https://vuldb.com/submit/811286
• https://vuldb.com/vuln/372557
• https://vuldb.com/vuln/372557/cti
• https://pypi.org/project/litellm
• https://github.com/advisories/GHSA-j37q-q7p9-vpwm

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

---

BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure

CVE-2026-12799 / GHSA-m2v5-74w2-qhcj / PYSEC-2026-4072

More information

Details

A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this issue is the function ui_view_users of the file litellm/proxy/management_endpoints/internal_user_endpoints.py of the component Incomplete Fix CVE-2025-0628. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

Severity

• CVSS Score: 2.1 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-12799
• https://gist.github.com/YLChen-007/3ace22e33e468d0166fe609c9fdf4184
• https://github.com/BerriAI/litellm
• https://vuldb.com/cve/CVE-2026-12799
• https://vuldb.com/submit/811291
• https://vuldb.com/vuln/372561
• https://vuldb.com/vuln/372561/cti
• https://pypi.org/project/litellm
• https://github.com/advisories/GHSA-m2v5-74w2-qhcj

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

---

LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration

CVE-2026-12772 / GHSA-mf52-j94g-746m / PYSEC-2026-4073

More information

Details

A security flaw has been discovered in BerriAI litellm up to 1.82.2. This impacts the function authenticate_user of the file litellm/proxy/auth/login_utils.py of the component PROXY_ADMIN database API Key Generator. Performing a manipulation results in session expiration. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.

Severity

• CVSS Score: 2.1 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-12772
• https://gist.github.com/YLChen-007/39ed709ce322431658a05b951e91f278
• https://github.com/BerriAI/litellm
• https://vuldb.com/cve/CVE-2026-12772
• https://vuldb.com/submit/811281
• https://vuldb.com/vuln/372514
• https://vuldb.com/vuln/372514/cti
• https://pypi.org/project/litellm
• https://github.com/advisories/GHSA-mf52-j94g-746m

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

---

LiteLLM: M2M JWT Handler Has Improper Authorization

CVE-2026-12771 / GHSA-qmf3-4767-5fg3 / PYSEC-2026-4075

More information

Details

A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/user_api_key_auth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

Severity

• CVSS Score: 1.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-12771
• https://gist.github.com/YLChen-007/70e4e106527f74ddf17953ff0f6c248d
• https://github.com/BerriAI/litellm
• https://vuldb.com/cve/CVE-2026-12771
• https://vuldb.com/submit/811280
• https://vuldb.com/vuln/372513
• https://vuldb.com/vuln/372513/cti
• https://pypi.org/project/litellm
• https://github.com/advisories/GHSA-qmf3-4767-5fg3

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

---

BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens

CVE-2026-12796 / GHSA-w2mh-qq9q-453x / PYSEC-2026-4076

More information

Details

A vulnerability was identified in BerriAI litellm up to 1.82.2. This impacts the function get_redirect_response_from_openid of the file litellm/proxy/management_endpoints/ui_sso.py of the component SSO Authentication Flow. The manipulation leads to session expiration. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

Severity

• CVSS Score: 2.1 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-12796
• https://gist.github.com/YLChen-007/5fa8af12e1b183674d7ca96d852fb697
• https://github.com/BerriAI/litellm
• https://vuldb.com/cve/CVE-2026-12796
• https://vuldb.com/submit/811287
• https://vuldb.com/vuln/372558
• https://vuldb.com/vuln/372558/cti
• https://pypi.org/project/litellm
• https://github.com/advisories/GHSA-w2mh-qq9q-453x

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

---

BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints

CVE-2026-12797 / GHSA-p897-vf7j-f5h8 / PYSEC-2026-4074

More information

Details

A security flaw has been discovered in BerriAI litellm up to 1.82.5. Affected is the function async_pre_call_hook of the file enterprise/enterprise_hooks/banned_keywords.py of the component Completions Interface. The manipulation of the argument prompt results in incorrect authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.

Severity

• CVSS Score: 2.1 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-12797
• https://gist.github.com/YLChen-007/078179224f07cc4e39e4f141a18c817a
• https://github.com/BerriAI/litellm
• https://vuldb.com/cve/CVE-2026-12797
• https://vuldb.com/submit/811288
• https://vuldb.com/vuln/372559
• https://vuldb.com/vuln/372559/cti

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints

CVE-2026-12797 / GHSA-p897-vf7j-f5h8 / PYSEC-2026-4074

More information

Details

A security flaw has been discovered in BerriAI litellm up to 1.82.5. Affected is the function async_pre_call_hook of the file enterprise/enterprise_hooks/banned_keywords.py of the component Completions Interface. The manipulation of the argument prompt results in incorrect authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.

Severity

• CVSS Score: 2.1 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-12797
• https://gist.github.com/YLChen-007/078179224f07cc4e39e4f141a18c817a
• https://github.com/BerriAI/litellm
• https://vuldb.com/cve/CVE-2026-12797
• https://vuldb.com/submit/811288
• https://vuldb.com/vuln/372559
• https://vuldb.com/vuln/372559/cti
• https://pypi.org/project/litellm
• https://github.com/advisories/GHSA-p897-vf7j-f5h8

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

---

LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint

CVE-2026-35029 / GHSA-53mr-6c8q-9789 / PYSEC-2026-2597

More information

Details

Impact

The /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to do the following:

• Modify proxy configuration and environment variables
• Register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution
• Read arbitrary server files by setting UI_LOGO_PATH and fetching via /get_image
• Take over other priveleged accounts by overwriting UI_USERNAME and UI_PASSWORD environment variables

Patches

Fixed in v1.83.0. The endpoint now requires proxy_admin role.

Workarounds

Restrict API key distribution. There is no configuration-level workaround.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N

References

• https://github.com/BerriAI/litellm/security/advisories/GHSA-53mr-6c8q-9789
• https://nvd.nist.gov/vuln/detail/CVE-2026-35029
• https://github.com/BerriAI/litellm
• http://seclists.org/fulldisclosure/2026/Apr/17

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

LiteLLM: Password hash exposure and pass-the-hash authentication bypass

GHSA-69x8-hrgq-fjj8

More information

Details

Impact

Three issues combine into a full authentication bypass chain:

1. Weak hashing: User passwords are stored as unsalted SHA-256 hashes, making them vulnerable to rainbow table attacks and trivially identifying users with identical passwords.
2. Hash exposure: Multiple API endpoints (/user/info, /user/update, /spend/users) return the password hash field in responses to any authenticated user regardless of role. Plaintext passwords could also potentially be exposed in certain scenarios.
3. Pass-the-hash: The /v2/login endpoint accepts the raw SHA-256 hash as a valid password without re-hashing, allowing direct login with a stolen

An already authenticated user can retrieve another user's password hash from the API and use it to log in as that user. This enables full privilege escalation in three HTTP requests.

Patches

Fixed in v1.83.0. Passwords are now hashed with scrypt (random 16-byte salt, n=16384, r=8, p=1). Password hashes are stripped from all API responses. Existing SHA-256 hashes are transparently migrated on next login.

Severity

• CVSS Score: 8.6 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/BerriAI/litellm/security/advisories/GHSA-69x8-hrgq-fjj8
• https://github.com/BerriAI/litellm

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

LiteLLM: Authentication bypass via OIDC userinfo cache key collision

CVE-2026-35030 / GHSA-jjhc-v7c2-5hh6 / PYSEC-2026-390

More information

Details

Impact

When JWT authentication is enabled (enable_jwt_auth: true), the OIDC userinfo cache uses token[:20] as the cache key. JWT headers produced by the same signing algorithm generate identical first 20 characters.

This configuration option is not enabled by default. Most instances are not affected.

An unauthenticated attacker can craft a token whose first 20 characters match a legitimate user's cached token. On cache hit, the attacker inherits the legitimate user's identity and permissions. This affects deployments with JWT/OIDC authentication enabled.

Patches

Fixed in v1.83.0. The cache key now uses the full hash of the JWT token.

Workarounds

Disable OIDC userinfo caching by setting the cache TTL to 0, or disable JWT authentication enti

[!IMPORTANT]
✂ PR body was truncated to here.