By vendor
Litellm vulnerabilities
Known CVEs affecting Litellm products, prioritized by severity, with SEC.co remediation and detection guidance.
10 published vulnerabilities
- CVE-2026-12773HIGH 7.3
BerriAI's litellm library contains an authentication bypass vulnerability in its MCP (Model Context Protocol) Proxy component. The UserAPIKeyAuth function fails to properly validate API keys, allowing remote attackers to bypass authentication controls without requiring credentials or special privileges. This affects litellm versions up to 1.59.8. Because the vulnerability is network-accessible and the exploit code is publicly available, organizations using affected versions face immediate risk of unauthorized access to their LLM proxy infrastructure.
- CVE-2026-12795HIGH 7.3
BerriAI's litellm, an open-source LLM proxy framework, contains an authentication bypass vulnerability in its Single Sign-On (SSO) debug flow. An unauthenticated remote attacker can manipulate the SSO debug endpoint to bypass authentication controls, gaining unauthorized access to the system. The vulnerability affects litellm versions up to and including 1.82.2, and exploit code has already been publicly disclosed.
- CVE-2026-12772MEDIUM 6.3
A vulnerability in the BerriAI litellm proxy authentication system allows authenticated users to manipulate session handling logic, leading to session expiration. An attacker with valid credentials can trigger this flaw remotely through the PROXY_ADMIN database API Key Generator component. The vulnerability affects litellm versions up to and including 1.82.2. Public exploit code is available, increasing the practical risk of exploitation.
- CVE-2026-12774MEDIUM 6.3
BerriAI's litellm, an LLM proxy and management library, contains a server-side request forgery (SSRF) vulnerability in its MCP Server connection testing functionality. An authenticated attacker can manipulate the MCP Server Connection Testing feature to make the litellm server send arbitrary HTTP requests to internal or external systems on behalf of the attacker. This flaw affects litellm versions up to 1.82.2 and requires valid credentials to exploit, limiting immediate risk but creating a meaningful exposure for organizations running vulnerable instances accessible to untrusted users or in multi-tenant environments.
- CVE-2026-12796MEDIUM 6.3
A flaw in BerriAI's litellm SSO authentication system allows authenticated users to trigger session expiration through manipulation of the OpenID redirect response handler. The vulnerability is network-accessible, requires valid credentials to exploit, and poses a moderate risk to applications relying on litellm's proxy authentication layer. Public exploit code exists, though no evidence of active weaponization in ransomware campaigns has been reported.
- CVE-2026-12797MEDIUM 6.3
A flaw in BerriAI's litellm library (versions up to 1.82.5) allows authenticated users to bypass keyword-based content filtering through manipulation of the prompt parameter in the Completions Interface. An attacker with valid credentials can craft requests that circumvent banned keyword restrictions, potentially exposing the system to restricted content or policy violations. Public exploit code exists for this issue.
- CVE-2026-12798MEDIUM 6.3
BerriAI's litellm library contains a server-side request forgery (SSRF) vulnerability in its MCP OpenAPI Spec Loader component. An authenticated attacker can manipulate the spec_path parameter to cause the server to make unintended network requests to internal or external systems. The vulnerability affects litellm versions up to 1.82.2 and requires valid authentication to exploit, limiting but not eliminating risk in many deployment scenarios.
- CVE-2026-12770MEDIUM 5.4
A security flaw was found in BerriAI's litellm, an open-source library for managing large language model API calls, affecting versions up to 1.63.1. The vulnerability resides in the admin key management system and allows authenticated users to perform actions they shouldn't be authorized to perform. An attacker who already has some level of access to the system could exploit this to modify or disrupt operations. The flaw has been publicly disclosed and patches are available.
- CVE-2026-12771MEDIUM 5.0
BerriAI's litellm, a language model proxy library, contains an authorization flaw in its M2M (machine-to-machine) JWT authentication handler. An authenticated attacker can manipulate requests to bypass proper authorization checks, potentially gaining unauthorized access to protected functionality. This requires existing credentials and significant technical knowledge to exploit, though proof-of-concept code is publicly available.
- CVE-2026-12799MEDIUM 4.3
BerriAI's litellm library contains an authorization flaw in its user management interface. An authenticated attacker can view unauthorized user information by exploiting an incomplete fix to a prior vulnerability. The issue affects versions up to 1.82.2 and requires valid credentials to exploit, limiting the immediate attack surface but posing a meaningful risk to multi-tenant deployments where user isolation is critical.