CVE-2026-47101-PoC

CVE-2026-47101 — LiteLLM Privilege Escalation via /key/generate + /user/update LiteLLM v1.82.6（v1.83.14 より前のバージョン）の /key/generate エンドポイントは、低権限の internaluser がワイルドカードルート "/" を持つ API キーをリクエストでき、続いて /user/update エンドポイント経由で自身のロールを proxyadmin に昇格させ、認可されていない権限昇格を実現できます。 Field| Value ---|--- CVE|...

The vulnerability of the `internal_user` function in the LiteLLM proxy server allows a hacker to increase their privileges and gain full control over the proxy server.

The vulnerability of the internaluser function in the LiteLLM proxy server is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to enhance their privileges and gain full control over the proxy server...

CVE-2026-47101

LiteLLM prior to 1.83.14 allows an authenticated internaluser to create API keys with access to routes that their role does not permit. When generating a key, the allowedroutes field is stored without verifying that the specified routes fall within the user's own permissions. A key created with...

CVE-2026-47101: Incorrect Authorization

LiteLLM prior to 1.83.14 allows an authenticated internaluser to create API keys with access to routes that their role does not permit. When generating a key, the allowedroutes field is stored without verifying that the specified routes fall within the user's own permissions. A key created with...