Vulnerabilities for litellm

First version without a known vulnerability: 1.101.0.dev1

Details

• GHSA-g5ff-637f-6q2m2026-10-27

  LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`

  Fixed in: 1.95.0

• GHSA-hhww-mrg2-969h2026-10-27

  LiteLLM vulnerable to reflected XSS in /sso/debug/callback

  Fixed in: 1.85.0

• GHSA-7hp6-4w63-5g452026-10-27

  LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key

  Fixed in: 1.100.4, 1.101.3, 1.102.2, 1.103.1, 1.104.0rc2

• GHSA-3cv6-jpf6-82222026-09-30

  LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters

  Fixed in: 1.88.6, 1.89.7, 1.90.7, 1.91.5, 1.92.2, 1.93.2, 1.94.3, 1.95.1, 1.96.2

• GHSA-hx8v-g79f-8w5f2026-09-17

  LiteLLM Proxy has server-side request forgery via the `user_config` request parameter

  Fixed in: 1.83.9

• GHSA-6wvf-77m9-58rm2026-08-27

  LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint

  Fixed in: 1.83.7

• GHSA-72m8-9m7m-h2782026-07-22

  LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks

  Fixed in: 1.82.0

• GHSA-7488-6r32-c95q2026-07-22

  LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

  Fixed in: 1.84.0

• GHSA-4g5m-c9r5-49xf2026-07-22

  LiteLLM: Local file read via request-supplied OIDC file references

  Fixed in: 1.83.10

• GHSA-5jmr-gcrj-2c9q2026-07-22

  LiteLLM: Arbitrary file write via path traversal in Skills archive extraction

  Fixed in: 1.83.7

• GHSA-c693-x898-5g4h2026-06-21

  BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader

• GHSA-m2v5-74w2-qhcj2026-06-21

  BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure

• GHSA-p897-vf7j-f5h82026-06-21

  BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints

• GHSA-w2mh-qq9q-453x2026-06-21

  BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens

• GHSA-j37q-q7p9-vpwm2026-06-21

  LiteLLM: SSO Debug Flow Has Improper Authentication

• GHSA-4jcj-7x88-m9792026-06-21

  LiteLLM: MCP Proxy Has Improper Authentication

  Fixed in: 1.84.0

• GHSA-6qr3-3g89-m4jj2026-06-21

  LiteLLM: Admin Key Handler Has Improper Authorization

• GHSA-mf52-j94g-746m2026-06-21

  LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration

• GHSA-qmf3-4767-5fg32026-06-21

  LiteLLM: M2M JWT Handler Has Improper Authorization

• GHSA-4xpc-pv4p-pm3w2026-06-16

  LiteLLM: Authentication Bypass via Host Header Injection

  Fixed in: 1.84.0

• GHSA-wpfp-gwwc-vwq62026-05-21

  LiteLLM allows a user to modify their own user_role via the /user/update endpoint

  Fixed in: 1.83.10

• GHSA-qrc4-49gv-mv9m2026-05-21

  LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit

  Fixed in: 1.83.14

• GHSA-wxxx-gvqv-xp7p2026-05-11

  LiteLLM has a sandbox escape in custom-code guardrail

  Fixed in: 1.83.10

• GHSA-v4p8-mg3p-g94g2026-04-25

  LiteLLM: Authenticated command execution via MCP stdio test endpoints

  Fixed in: 1.83.7

• GHSA-r75f-5x8p-qvmc2026-04-24

  LiteLLM has SQL Injection in Proxy API key verification

  Fixed in: 1.83.7

• GHSA-xqmj-j6mv-48622026-04-24

  LiteLLM: Server-Side Template Injection in /prompts/test endpoint

  Fixed in: 1.83.7

• GHSA-69x8-hrgq-fjj82026-04-08

  LiteLLM: Password hash exposure and pass-the-hash authentication bypass

  Fixed in: 1.83.0

• GHSA-jjhc-v7c2-5hh62026-04-03

  LiteLLM: Authentication bypass via OIDC userinfo cache key collision

  Fixed in: 1.83.0

• GHSA-53mr-6c8q-97892026-04-03

  LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint

  Fixed in: 1.83.0

• GHSA-5mg7-485q-xm762026-03-25

  Two LiteLLM versions published containing credential harvesting malware

• MAL-2026-21442026-03-24

  Malicious code in litellm (PyPI)

• GHSA-879v-fggm-vxw22025-03-20

  LiteLLM Has a Leakage of Langfuse API Keys

• GHSA-fjcf-3j3r-78rp2025-03-20

  LiteLLM Has an Improper Authorization Vulnerability

  Fixed in: 1.61.15

• GHSA-g5pg-73fc-hjwq2025-03-20

  LiteLLM Reveals Portion of API Key via a Logging File

  Fixed in: 1.44.12

• GHSA-fh2c-86xm-pm2x2025-03-20

  LiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP Request

  Fixed in: 1.56.2

• GHSA-53gh-p8jc-7rg82025-03-20

  LiteLLM Vulnerable to Remote Code Execution (RCE)

• GHSA-gw2q-qw9j-rgv72025-03-20

  LiteLLM Vulnerable to Denial of Service (DoS)

  Fixed in: 1.53.1.dev1

• GHSA-g26j-5385-hhw32024-09-13

  LiteLLM Server-Side Request Forgery (SSRF) vulnerability

  Fixed in: 1.44.8

• GHSA-gppg-gqw8-wh9g2024-06-27

  litellm vulnerable to remote code execution based on using eval unsafely

  Fixed in: 1.40.16

• GHSA-qqcv-vg9f-5rr32024-06-27

  litellm vulnerable to improper access control in team management

  Fixed in: 1.40.15

• GHSA-3xr8-qfvj-9p9j2024-06-06

  Arbitrary file deletion in litellm

  Fixed in: 1.35.36

• GHSA-8j42-pcfm-34672024-06-06

  SQL injection in litellm

• GHSA-h6m6-jj8v-94jj2024-06-06

  SQL injection in litellm

  Fixed in: 1.40.0

• GHSA-7ggm-4rjg-594w2024-05-18

  litellm passes untrusted data to `eval` function without sanitization

• GHSA-46cm-pfwv-cgf82024-04-10

  LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint

  Fixed in: 1.34.42