Skip to content
OpenAdvisories
High 1 exploited CVE WID-SEC-2026-2263 4 CVEs

LiteLLM: Mehrere Schwachstellen

Published Jul 8, 2026 · Updated Sep 2, 2026 · Revision 2 · de-DE

Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in LiteLLM ausnutzen, um Informationen offenzulegen, Daten zu manipulieren, Code auszuführen und um Sicherheitsmaßnahmen zu umgehen.

Product

LiteLLM ist ein Gateway, das eine einheitliche Schnittstelle für verschiedene Large Language Models (LLMs) bietet.

Vulnerabilities 4

  • High 8.8
    CVE-2026-59822 Exploited Public exploit

    LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

    LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallbac…

    BerriAI litellm litellm PyPI
    KEV Sep 2, 2026
  • Medium 6.1
    CVE-2026-59820

    LiteLLM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

    LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.7-stable, LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives, allowing an authenticated user with acce…

    BerriAI litellm litellm PyPI
  • Low 2.1
    CVE-2026-59819

    LiteLLM: Local file read via request-supplied OIDC file references

    LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.10-stable, LiteLLM's /health/test_connection endpoint resolved request-supplied environment and OIDC file references in litellm_params, allowing a proxy admini…

    BerriAI litellm litellm PyPI
  • Low 2.1
    CVE-2026-59821

    LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks

    LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allow…

    BerriAI litellm litellm PyPI

Revision history

  1. #2

    Aktive Ausnutzung gemeldet

  2. #1

    Initiale Fassung

References