Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in LiteLLM ausnutzen, um Informationen offenzulegen, Daten zu manipulieren und Sicherheitsmaßnahmen zu umgehen.
Product
LiteLLM ist ein Gateway, das eine einheitliche Schnittstelle für verschiedene Large Language Models (LLMs) bietet.
Vulnerabilities 2
-
Medium 6.3
BerriAI LiteLLM Secret Resolution main.py get_secret improper authorization
A vulnerability has been found in BerriAI LiteLLM up to 1.94.0. This affects the function get_secret of the file secret_managers/main.py of the component Secret Resolution. The manipulation of the argument api_key leads to improper authorization. The attack c…
-
Medium 4.3
BerriAI LiteLLM Spend Tracking spend_management_endpoints.py ui_view_session_spend_logs authorization
A flaw has been found in BerriAI LiteLLM up to 1.95.0. Affected by this issue is the function ui_view_session_spend_logs of the file litellm/proxy/spend_tracking/spend_management_endpoints.py of the component Spend Tracking. Executing a manipulation of the ar…
Revision history
-
#1
Initiale Fassung
References
-
GitHub Advisory Database vom 2026-10-11
https://github.com/advisories/GHSA-WXJW-VCVF-MVW9
-
GitHub Advisory Database vom 2026-10-11
https://github.com/advisories/GHSA-GW95-8PCG-7GVV