CVE-2026-12770: Improper Authorization in BerriAI litellm Admin Key Handler

Technical summary

CVE-2026-12770 is an improper authorization vulnerability (CWE-266, CWE-285) in the Admin Key Handler component of litellm's key management endpoints. The vulnerability exists in litellm/proxy/management_endpoints/key_management_endpoints.py and fails to properly validate authorization controls, allowing authenticated users with limited privileges to perform administrative actions. The vulnerability is remotely exploitable from an authenticated context and carries a CVSS 3.1 score of 5.4 (Medium severity). The attack vector is network-based, requires low complexity, and necessitates prior authentication (PR:L). It impacts integrity and availability but not confidentiality.

Business impact

Organizations deploying litellm for LLM API gateway and management functions face potential disruption if an authenticated user—such as a developer, contractor, or compromised account—gains unauthorized administrative capabilities. This could lead to unauthorized modification of API keys, disruption of LLM service routing, or interference with rate-limiting and access controls. In multi-tenant or shared proxy environments, this escalates risk significantly. The impact is constrained to integrity and availability rather than wholesale data breach, but could cause operational outage or unauthorized service manipulation.

Affected systems

The vulnerability affects BerriAI litellm versions up to and including 1.63.1. Any deployment using the litellm proxy with the admin key management endpoints is at risk. This includes self-hosted litellm proxy instances and applications that depend on litellm's key management features for multi-user or multi-tenant API access control.

Exploitability

Exploitation requires network access and prior authentication to the litellm proxy. An authenticated user—either a legitimate user with limited permissions or an attacker who has compromised credentials—can craft requests to the key management endpoints to perform unauthorized administrative operations. The low attack complexity and public disclosure increase risk; however, the requirement for prior authentication limits the immediate blast radius. No CISA KEV listing currently exists, but the public disclosure means weaponized proof-of-concept tools may emerge quickly.

Remediation

Update litellm to a patched version that incorporates patch 23781 or later. Verify the exact patched version number against the official BerriAI litellm release notes and GitHub repository. In the interim, restrict network access to litellm proxy administrative endpoints to trusted internal networks only, and enforce strong authentication and least-privilege access policies for all user accounts with proxy access. Monitor key management endpoint logs for suspicious activity.

Patch guidance

BerriAI has released a patch identified as patch 23781. Users should apply this patch immediately by updating litellm from their current version to the next available patched release. Verify the patch version number against the official BerriAI GitHub releases page and changelog. Test the patched version in a staging environment before deploying to production. If you are unable to patch immediately, compensate by restricting network-level access to the litellm proxy admin endpoints and enforcing multi-factor authentication for proxy user accounts.

Detection guidance

Monitor litellm proxy logs for anomalous access patterns to the key management endpoints (litellm/proxy/management_endpoints/key_management_endpoints.py), particularly unauthorized admin operations initiated by non-administrator users. Look for unusual key creation, modification, or deletion events. Implement alerting on privilege escalation attempts within the proxy. Network-level detection should flag unexpected traffic to administrative endpoints from non-admin user contexts. Review proxy user access logs for accounts with inconsistent access patterns.

Why prioritize this

Although the CVSS score is Medium (5.4), this vulnerability merits timely attention because it involves authenticated privilege escalation affecting service integrity and availability. Public disclosure increases the likelihood of active exploitation. Organizations with multi-user or multi-tenant litellm deployments should prioritize patching within 1–2 weeks. Single-user or isolated deployments can be addressed within normal patching cycles, provided compensating network controls are in place.

Risk score, explained

The CVSS 3.1 score of 5.4 (Medium) reflects a vulnerability that requires prior authentication and results in limited impact—integrity and availability of the service rather than confidentiality breaches. The network attack vector and low complexity increase exploitability once a user is authenticated. The Medium severity appropriately captures the real-world risk: in single-user setups, risk is minimal; in shared proxy environments with many users or tenants, the risk rises because one compromised or malicious user can impact others. Prioritize based on your deployment model.

Frequently asked questions