By vendor

Litellm vulnerabilities

Known CVEs affecting Litellm products, prioritized by severity, with SEC.co remediation and detection guidance.

14 published vulnerabilities

• CVE-2026-59822HIGH 8.2

  LiteLLM, an AI Gateway proxy for unified LLM API access, contained an authentication bypass in its MCP Streamable HTTP endpoint. Attackers could craft a fake Authorization header to trigger a fallback mechanism that replaced proper API key validation with an empty authentication object, allowing unauthorized access to MCP tooling. This issue affects versions prior to 1.84.0 and has been patched.

• CVE-2026-12773HIGH 7.3

  BerriAI's litellm library contains an authentication bypass vulnerability in its MCP (Model Context Protocol) Proxy component. The UserAPIKeyAuth function fails to properly validate API keys, allowing remote attackers to bypass authentication controls without requiring credentials or special privileges. This affects litellm versions up to 1.59.8. Because the vulnerability is network-accessible and the exploit code is publicly available, organizations using affected versions face immediate risk of unauthorized access to their LLM proxy infrastructure.

• CVE-2026-12795HIGH 7.3

  BerriAI's litellm, an open-source LLM proxy framework, contains an authentication bypass vulnerability in its Single Sign-On (SSO) debug flow. An unauthenticated remote attacker can manipulate the SSO debug endpoint to bypass authentication controls, gaining unauthorized access to the system. The vulnerability affects litellm versions up to and including 1.82.2, and exploit code has already been publicly disclosed.

• CVE-2026-59821HIGH 7.2

  LiteLLM is a proxy server that helps applications communicate with various large language model APIs in a standardized way. A security gap was discovered in how the product handles custom code guardrails—safety rules written in Python that can inspect or filter API requests. Before version 1.82.0-stable, administrators with permission to create or update these guardrails could upload malicious Python code that would execute directly within the LiteLLM proxy process. This execution could potentially expose sensitive secrets (like API keys or credentials) that the proxy has access to. The vulnerability requires an authenticated, privileged user to exploit, limiting the immediate attack surface, but the consequences are severe.

• CVE-2026-59820MEDIUM 6.5

  LiteLLM, a proxy server used to standardize API calls to various large language models, contains a path traversal vulnerability in its skill upload feature. An authenticated user who has permission to upload skills can craft a malicious ZIP file that extracts files outside the intended directory, potentially overwriting system files or placing malicious content in sensitive locations. This requires existing API access and doesn't directly cause data theft or system crashes, but enables an attacker to modify files on the server.

• CVE-2026-12772MEDIUM 6.3

  A vulnerability in the BerriAI litellm proxy authentication system allows authenticated users to manipulate session handling logic, leading to session expiration. An attacker with valid credentials can trigger this flaw remotely through the PROXY_ADMIN database API Key Generator component. The vulnerability affects litellm versions up to and including 1.82.2. Public exploit code is available, increasing the practical risk of exploitation.

• CVE-2026-12774MEDIUM 6.3

  BerriAI's litellm, an LLM proxy and management library, contains a server-side request forgery (SSRF) vulnerability in its MCP Server connection testing functionality. An authenticated attacker can manipulate the MCP Server Connection Testing feature to make the litellm server send arbitrary HTTP requests to internal or external systems on behalf of the attacker. This flaw affects litellm versions up to 1.82.2 and requires valid credentials to exploit, limiting immediate risk but creating a meaningful exposure for organizations running vulnerable instances accessible to untrusted users or in multi-tenant environments.

• CVE-2026-12796MEDIUM 6.3

  A flaw in BerriAI's litellm SSO authentication system allows authenticated users to trigger session expiration through manipulation of the OpenID redirect response handler. The vulnerability is network-accessible, requires valid credentials to exploit, and poses a moderate risk to applications relying on litellm's proxy authentication layer. Public exploit code exists, though no evidence of active weaponization in ransomware campaigns has been reported.

• CVE-2026-12797MEDIUM 6.3

  A flaw in BerriAI's litellm library (versions up to 1.82.5) allows authenticated users to bypass keyword-based content filtering through manipulation of the prompt parameter in the Completions Interface. An attacker with valid credentials can craft requests that circumvent banned keyword restrictions, potentially exposing the system to restricted content or policy violations. Public exploit code exists for this issue.

• CVE-2026-12798MEDIUM 6.3

  BerriAI's litellm library contains a server-side request forgery (SSRF) vulnerability in its MCP OpenAPI Spec Loader component. An authenticated attacker can manipulate the spec_path parameter to cause the server to make unintended network requests to internal or external systems. The vulnerability affects litellm versions up to 1.82.2 and requires valid authentication to exploit, limiting but not eliminating risk in many deployment scenarios.

• CVE-2026-12770MEDIUM 5.4

  A security flaw was found in BerriAI's litellm, an open-source library for managing large language model API calls, affecting versions up to 1.63.1. The vulnerability resides in the admin key management system and allows authenticated users to perform actions they shouldn't be authorized to perform. An attacker who already has some level of access to the system could exploit this to modify or disrupt operations. The flaw has been publicly disclosed and patches are available.

• CVE-2026-12771MEDIUM 5.0

  BerriAI's litellm, a language model proxy library, contains an authorization flaw in its M2M (machine-to-machine) JWT authentication handler. An authenticated attacker can manipulate requests to bypass proper authorization checks, potentially gaining unauthorized access to protected functionality. This requires existing credentials and significant technical knowledge to exploit, though proof-of-concept code is publicly available.

• CVE-2026-59819MEDIUM 4.9

  LiteLLM, a proxy server used to standardize API calls to large language models, contains a vulnerability in its connection testing endpoint that allows authorized administrators to read sensitive files from the server's filesystem. An attacker with legitimate access to the `/health/test_connection` API could craft requests that reference local files via OIDC configuration parameters, effectively bypassing normal file access restrictions. This affects versions before 1.83.10-stable and is particularly concerning in shared or multi-tenant environments where proxy administration privileges may be distributed.

• CVE-2026-12799MEDIUM 4.3

  BerriAI's litellm library contains an authorization flaw in its user management interface. An authenticated attacker can view unauthorized user information by exploiting an incomplete fix to a prior vulnerability. The issue affects versions up to 1.82.2 and requires valid credentials to exploit, limiting the immediate attack surface but posing a meaningful risk to multi-tenant deployments where user isolation is critical.