Skip to content
OpenAdvisories

Package · PyPI

litellm

45 known vulnerabilities.

Malicious versions reported for this package

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.8
    CVE-2026-59822 Exploited Public exploit

    LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

    LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallbac…

    BerriAI litellm litellm PyPI
    KEV Sep 2, 2026
  • High 8.8
    CVE-2026-47102 Public exploit

    LiteLLM < 1.83.10 Privilege Escalation via User Update

    LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint. While the endpoint correctly restricts users to updating only their own account, it does not restrict which fields may be changed. A user who can reach this en…

    BerriAI litellm airflow-3 litellm Wolfi PyPI
  • High 8.8
    CVE-2026-47101 Public exploit

    LiteLLM < 1.83.14 Privilege Escalation via API Key Generation

    LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit. When generating a key, the allowed_routes field is stored without verifying that the specified routes fall within the user…

    BerriAI litellm airflow-3 litellm Wolfi PyPI
  • High 8.6
    CVE-2026-42203 Public exploit

    LiteLLM: Server-Side Template Injection in /prompts/test endpoint

    LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.80.5 to before version 1.83.7, the POST /prompts/test endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted templat…

    BerriAI litellm airflow-3 litellm Wolfi PyPI
  • High 8.7
    CVE-2026-42271 Exploited Public exploit Scanner template EPSS 91%

    LiteLLM: Authenticated command execution via MCP stdio test endpoints

    LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/lis…

    BerriAI litellm airflow-3 litellm Wolfi PyPI
    KEV Jun 8, 2026
  • High 8.8
    CVE-2026-40217 Public exploit Scanner template EPSS 17%

    LiteLLM has a sandbox escape in custom-code guardrail

    LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.

    BerriAI litellm airflow-3 litellm Wolfi PyPI
  • High 8.7
    CVE-2026-35029 Public exploit Scanner template EPSS 39%

    LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint

    LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to m…

    BerriAI litellm airflow-3 litellm Wolfi PyPI