litellm-command-injection-security-assessment

CVE-2026-42271 - LiteLLM AI Gateway MCP Command Injection RCE Consultant-Style Cybersecurity Report Professional vulnerability assessment report for LiteLLM command injection risk, including executive summary, technical impact, remediation, and mitigation strategy. 📍 Report Snapshot Field| Detail...

GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers

A critical flaw in GitLab's AI Gateway could let a logged-in user with Duo Agent Platform access run commands on the gateway under certain conditions, GitLab said in an advisory. The gateway is the service that connects a GitLab instance to AI models, and only organizations that host their own...

CVE-2026-90970

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape...

CVE-2026-90970

GitLab has remediated a critical vulnerability in the GitLab AI Gateway component (CWE-1336) affecting versions 18.1.6 before 19.2.4 , 19.3 before 19.3.2 , and 19.4 before 19.4.1 . An authenticated user with Duo Agent Platform access could exploit a template engine weakness to escape the prompt t...

CVE-2026-90970 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape...

EUVD-2026-91651

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape...

CVE-2026-90970 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape...

PT-2026-104355

Name of the Vulnerable Software and Affected Versions GitLab AI Gateway versions 18.1.6 through 19.2.3 GitLab AI Gateway versions 19.3 through 19.3.1 GitLab AI Gateway versions 19.4 through 19.4.0 Description An improper neutralization weakness in the GitLab AI Gateway allows an authenticated use...

aegis-latent-core

Aegis Latent Core Шлюз управления ИИ и криптографических доказательств Aegis Latent Core фиксирует подписанные, связанные хешами доказательства каждого управляемого вызова ИИ — до того, как ответ достигнет вызывающей стороны — и выдаёт переносное доказательство, которое третья сторона проверяет, ...

CVE-2026-42208

✦ CVE-2026-42208 - Critical SQL Injection in LiteLLM 🧭 Overview CVE-2026-42208 is a critical pre-authentication SQL injection vulnerability affecting the LiteLLM AI gateway. It allows attackers to exploit backend database queries without authentication , potentially exposing sensitive AI...

EUVD-2026-70236

LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters...

CVE-2026-59823 LiteLLM: Server-side request forgery via the `user_config` request parameter in LiteLLM Proxy

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to 1.83.9, an authenticated LiteLLM Proxy caller with a valid virtual key can place apibase inside the userconfig request body to bypass isrequestbodysafe, which blocks top-level apibase and baseurl but...

CVE-2026-59823 LiteLLM: Server-side request forgery via the `user_config` request parameter in LiteLLM Proxy

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to 1.83.9, an authenticated LiteLLM Proxy caller with a valid virtual key can place apibase inside the userconfig request body to bypass isrequestbodysafe, which blocks top-level apibase and baseurl but...

CVE-2026-53708 ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for MCP, A2A, and REST or gRPC APIs. Prior to 1.0.3, the /admin/gateways/test call site in mcpgateway/admin.py calls validategatewaytesturl in mcpgateway/common/validators.py to...

CVE-2026-53708 ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for MCP, A2A, and REST or gRPC APIs. Prior to 1.0.3, the /admin/gateways/test call site in mcpgateway/admin.py calls validategatewaytesturl in mcpgateway/common/validators.py to...

CVE-2026-88062

OmniRoute is an open-source AI gateway providing a single endpoint for multiple model providers. In 3.8.49 and earlier, the OmniRoute POST /api/acp/agents custom ACP agent endpoint accepted attacker-controlled binary and versionCommand values and used only a self-consistency check before...

CVE-2026-88062 OmniRoute ACP Custom-Agent Remote Code Execution (RCE)

OmniRoute is an open-source AI gateway providing a single endpoint for multiple model providers. In 3.8.49 and earlier, the OmniRoute POST /api/acp/agents custom ACP agent endpoint accepted attacker-controlled binary and versionCommand values and used only a self-consistency check before...

CVE-2026-88062 OmniRoute ACP Custom-Agent Remote Code Execution (RCE)

OmniRoute is an open-source AI gateway providing a single endpoint for multiple model providers. In 3.8.49 and earlier, the OmniRoute POST /api/acp/agents custom ACP agent endpoint accepted attacker-controlled binary and versionCommand values and used only a self-consistency check before...

CVE-2026-88062 OmniRoute ACP Custom-Agent Remote Code Execution (RCE)

OmniRoute is an open-source AI gateway providing a single endpoint for multiple model providers. In 3.8.49 and earlier, the OmniRoute POST /api/acp/agents custom ACP agent endpoint accepted attacker-controlled binary and versionCommand values and used only a self-consistency check before...

MLflow AI Gateway permits SSRF through an unvalidated api_base

MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...