LiteLLM - Server-Side Request Forgery

LiteLLM vulnerable to Server-Side Request Forgery SSRF vulnerability Exposes OpenAI API Keys. id: CVE-2024-6587 info: name: LiteLLM - Server-Side Request Forgery author: pdresearch,iamnoooob,rootxharsh,lambdasawa severity: high description: | LiteLLM vulnerable to Server-Side Request Forgery SSRF...

LiteLLM - SQL Injection

LiteLLM 1.81.16 to 1.83.7 contains a SQL injection caused by improper handling of caller-supplied key in database query during proxy API key checks, letting unauthenticated attackers read and modify database data, exploit requires crafted Authorization header. id: CVE-2026-42208 info: name: LiteL...

LiteLLM Proxy < 1.84.0 - Host Header Authentication Bypass

LiteLLM Proxy before 1.84.0 derives its public-route authorization check from a URL reconstructed with the unvalidated Host header. A Host value containing a fragment can make a protected request appear to target the public root route, bypassing the API-key check. Version 1.84.0 derives the route...

LiteLLM - Arbitrary File Read

LiteLLM 1.83.0 contains a broken access control vulnerability caused by lack of admin role enforcement on /config/update endpoint, letting authenticated users modify configurations, execute code, read files, and take over accounts. id: CVE-2026-35029 info: name: LiteLLM - Arbitrary File Read...

LiteLLM < 1.25.0 - Remote Code Execution

LiteLLM before 1.25.0 allows authenticated users with the master API key to execute arbitrary Python code through the /guardrails/testcustomcode endpoint intended for custom guardrail testing. The endpoint’s insufficient filtering mechanisms can be bypassed, allowing attackers to abuse Python’s...

EXPLOIT-CVE-2026-33634

CVE-2026-33634 — LiteLLM サプライチェーン + apibase における SSRF PoC / ラボ ⚠️ 意図的に脆弱なラボであり、教育および許可された用途向けです。 自分のマシン上で、このリポジトリのコンテナに対してのみ実行してください。 開始前に SECURITY-NOTES.md をお読みください。 🚫 このラボをクラウド VM や共有マシン上で絶対に実行しないでください。 このゲートウェイは意図的に無制限の SSRF を持っています。実際の IMDS 169.254.169.254 や loopback/LAN 上の機密サービスが存在する場合、SSRF は...

CVE-2026-42208-Lab

CVE-2026-42208 — LiteLLM 事前認証SQLインジェクションのタイミングPoC CVE-2026-42208（LiteLLM ProxyのAPIキー検証パスにおける事前認証SQLインジェクションの脆弱性）のためのローカルDockerラボおよび最小限の害を伴うPoCです。 このリポジトリは、タイミングベースのPostgreSQL pgsleep 証明を使用して、脆弱なLiteLLMインスタンスとパッチ適用済みLiteLLMインスタンスの違いを示します。 適用範囲: ローカルラボ / 許可されたテストのみ。デフォルトのPoCはデータベースデータのダンプや変更を行いません。...

CVE-2026-42208_lab

LiteLLM Proxy SQLインジェクション（GHSA-r75f-5x8p-qvmc） LiteLLM ProxyのAPIキー認証フローにおけるSQLインジェクション脆弱性の再現環境です。 脆弱性の概要 項目| 詳細 ---|--- アドバイザリ| GHSA-r75f-5x8p-qvmc 種別| SQLインジェクション（CWE-89） 深刻度| Critical 影響を受けるバージョン| litellm =1.81.16, =1.83.7（コミット 4dc416ee74） 攻撃経路 インジェクションはエラーハンドリングコールバック経路...

threat-intel-brief-cve-2026-42208-litellm

脅威インテリジェンス速報 - CVE-2026-42208: BerriAI LiteLLM SQLインジェクション CVE: CVE-2026-42208 GHSA: GHSA-r75f-5x8p-qvmc CVSSスコア: 9.3（緊急） 影響を受けるソフトウェア: BerriAI LiteLLM バージョン = 1.81.16、 1.83.7 修正バージョン: 1.83.7-stable（2026年4月19日リリース） CISA KEV追加日: 2026年5月8日 情報源: CISA KEV、Sysdig TRT、The Hacker News、Security Affairs...

LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters

ImpactAny authenticated LiteLLM proxy user could redirect an outbound provider call to a destination they control and cause the proxy to send its own configured provider credentials to that destination. The proxy's request-body validation was a denylist that did not cover every sensitive paramete...

LiteLLM Proxy has server-side request forgery via the `user_config` request parameter

SummaryA server-side request forgery in LiteLLM Proxy lets an authenticated caller redirect theproxy's outbound request to a host of their choosing by smuggling an apibase inside theuserconfig request body, bypassing the existing parameter guard. DetailsLiteLLM Proxy validates request bodies with...

BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens

A vulnerability was identified in BerriAI litellm up to 1.82.2. This impacts the function getredirectresponsefromopenid of the file litellm/proxy/managementendpoints/uisso.py of the component SSO Authentication Flow. The manipulation leads to session expiration. The attack is possible to be carri...

LiteLLM: MCP Proxy Has Improper Authentication

A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file litellm/proxy/experimental/mcpserver/auth/userapikeyauthmcp.py of the component MCP Proxy. Executing a manipulation can lead to improper authentication. The attack may be launched...

BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader

A weakness has been identified in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function loadopenapispecasync of the file litellm/proxy/experimental/mcpserver/openapitomcpgenerator.py of the component MCP OpenAPI Spec Loader. This manipulation of the argument specpath causes...

BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints

A security flaw has been discovered in BerriAI litellm up to 1.82.5. Affected is the function asyncprecallhook of the file enterprise/enterprisehooks/bannedkeywords.py of the component Completions Interface. The manipulation of the argument prompt results in incorrect authorization. The attack ma...

LiteLLM: SSO Debug Flow Has Improper Authentication

A vulnerability was determined in BerriAI litellm up to 1.82.2. This affects the function json.dumps of the file litellm/proxy/managementendpoints/uisso.py of the component SSO Debug Flow. Executing a manipulation can lead to missing authentication. The attack can be executed remotely. The exploi...

BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure

A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this issue is the function uiviewusers of the file litellm/proxy/managementendpoints/internaluserendpoints.py of the component Incomplete Fix CVE-2025-0628. Such manipulation leads to improper authorization. I...

LiteLLM: M2M JWT Handler Has Improper Authorization

A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/userapikeyauth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is...

LiteLLM: Admin Key Handler Has Improper Authorization

A vulnerability was determined in BerriAI litellm up to 1.63.1. The impacted element is an unknown function of the file litellm/proxy/managementendpoints/keymanagementendpoints.py of the component Admin Key Handler. This manipulation causes improper authorization. The attack can be initiated...

LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration

A security flaw has been discovered in BerriAI litellm up to 1.82.2. This impacts the function authenticateuser of the file litellm/proxy/auth/loginutils.py of the component PROXYADMIN database API Key Generator. Performing a manipulation results in session expiration. The attack may be initiated...