EUVD-2026-42350

LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks...

EUVD-2026-42359

LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback...

GHSA-4G5M-C9R5-49XF LiteLLM: Local file read via request-supplied OIDC file references

Impact LiteLLM's /health/testconnection endpoint resolved request-supplied environment and OIDC file references in litellmparams. A proxy administrator, or another privileged caller with permission to test model connections, could cause LiteLLM to read files from the local filesystem via an...

EUVD-2026-42361

LiteLLM: Local file read via request-supplied OIDC file references...

GHSA-JPW9-PFVF-9F58 vulnerabilities

Vulnerabilities for packages: litellm, semgrep...

CVE-2026-52869 vulnerabilities

Vulnerabilities for packages: litellm, semgrep...

CVE-2026-52870 vulnerabilities

Vulnerabilities for packages: litellm, semgrep...

GHSA-VJ7Q-GJH5-988W vulnerabilities

Vulnerabilities for packages: lmcache-cuda-12.8, litellm, semgrep, tritonserver-backend-vllm-cuda-13.0...

CVE-2026-59950 vulnerabilities

Vulnerabilities for packages: lmcache-cuda-12.8, litellm, semgrep, tritonserver-backend-vllm-cuda-13.0...

GHSA-HVRP-RF83-W775 vulnerabilities

Vulnerabilities for packages: litellm, semgrep...

CLEANSTART-2026-EH47852 Security fixes for CVE-2026-34180, CVE-2026-48155, CVE-2026-48156, CVE-2026-48522, CVE-2026-48523, CVE-2026-48524, CVE-2026-48525, CVE-2026-48526, CVE-2026-48710, CVE-2026-48735, CVE-2026-48817, CVE-2026-48818, CVE-2026-49460, CVE-2026-49461, CVE-2026-53537, CVE-2026-53538, CVE-2026-53539, CVE-2026-53540, CVE-2026-54282, CVE-2026-54283, CVE-2026-54530, CVE-2026-54531, CVE-2026-54651, CVE-2026-57204, CVE-2026-59935, CVE-2026-59936, CVE-2026-59937, CVE-2026-59938, ghsa-537c-gmf6-5ccf, ghsa-jm82-fx9c-mx94 applied in versions: 1.85.1-r0, 1.89.5-r0, 1.90.2-r0

Multiple security vulnerabilities affect the litellm-database package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-GN02455 Security fixes for CVE-2026-34180, CVE-2026-48155, CVE-2026-48156, CVE-2026-48522, CVE-2026-48523, CVE-2026-48524, CVE-2026-48525, CVE-2026-48526, CVE-2026-48710, CVE-2026-48735, CVE-2026-48817, CVE-2026-48818, CVE-2026-49460, CVE-2026-49461, CVE-2026-53537, CVE-2026-53538, CVE-2026-53539, CVE-2026-53540, CVE-2026-54282, CVE-2026-54283, CVE-2026-54530, CVE-2026-54531, CVE-2026-54651, CVE-2026-57204, CVE-2026-59935, CVE-2026-59936, CVE-2026-59937, CVE-2026-59938, ghsa-537c-gmf6-5ccf, ghsa-jm82-fx9c-mx94 applied in versions: 1.85.1-r0, 1.88.5-r0, 1.90.2-r0

Multiple security vulnerabilities affect the litellm-database package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-30623

A flaw was found in LiteLLM. This vulnerability allows a remote attacker to execute arbitrary operating system commands on the host where LiteLLM is running. This is possible because the application's MCP server creation functionality processes JSON configurations that can include unvalidated...

EUVD-2026-44846

LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application allows users to add MCP servers via a JSON configuration specifying arbitrary command and args values. LiteLLM executes these values on the host without validation, enabling...

Command Injection

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Command Injection in the createmcpclient function, which passes a user-supplied command value into StdioServerParameters and executes it as a subprocess on the proxy host...

CVE-2026-30623

CVE-2026-30623 affects LiteLLM 1.18.10 via the MCP server creation feature. The vulnerability arises when MCP configuration JSON can set arbitrary values for command and args, which LiteLLM executes on the host without validation, enabling remote code execution with the LiteLLM process privileges...

CVE-2026-30623

LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application allows users to add MCP servers via a JSON configuration specifying arbitrary command and args values. LiteLLM executes these values on the host without validation, enabling...

PYSEC-2026-2600 LiteLLM allows a user to modify their own user_role via the /user/update endpoint

LiteLLM prior to 1.83.10 allows a user to modify their own userrole via the /user/update endpoint. While the endpoint correctly restricts users to updating only their own account, it does not restrict which fields may be changed. A user who can reach this endpoint can set their role to proxyadmin...

PYSEC-2026-2602 LiteLLM: Server-Side Template Injection in /prompts/test endpoint

Impact The POST /prompts/test endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted template could run arbitrary code inside the LiteLLM Proxy process. The endpoint only checks that the caller presents a valid proxy API key, so any authenticated user cou...

CVE-2026-59821

A flaw was found in LiteLLM, a proxy server for Large Language Model LLM APIs. A privileged user with access to create or update custom code guardrails could exploit this vulnerability. The flaw allowed the user to submit custom Python code that would execute within the LiteLLM proxy environment,...