tag
Litellm
LiteLLM Proxy Pre-Authentication SQL Injection via Error-Handling Callback (CVE-2026-42208)
LiteLLM Proxy authenticates API requests by checking that the Authorization: Bearer token starts with sk-. When a caller sends a token that does not start with sk-, that assertion fails — but instead of simply rejecting the request, the raw, unhashed token is…
LiteLLM Proxy Unauthenticated Auth Bypass via Host-Header Route Confusion (CVE-2026-49468)
exploit.py demonstrates a pre-authentication bypass in the LiteLLM proxy caused by a single crafted Host header (Host: evil/?). LiteLLM's getrequestroute() derives the route used for auth decisions from request.url.path, which Starlette reconstructs from the…
LiteLLM Proxy Privilege Escalation via `/user/update` (CVE-2026-47102)
LiteLLM's /user/update endpoint is meant to let a user update their own account attributes (name, email, metadata). The authorization check canusercalluserupdate() only verifies which user record the caller may modify (their own, or any if they are already…
LiteLLM Guardrail Custom-Code Sandbox Escape to Root RCE (CVE-2026-40217)
LiteLLM's guardrail-testing endpoint lets authenticated users submit custom Python code that is checked with a regex-based source-code filter meant to block dangerous identifiers such as globals, builtins, and import. Because the filter only inspects source…
LiteLLM Authentication Bypass via OIDC Userinfo Cache Key Collision (CVE-2026-35030)
LiteLLM's OIDC userinfo cache uses only the first 20 characters of the presented JWT (token[:20]) as its cache key. Two different, validly-signed JWTs can be crafted to share identical first-20-character prefixes, allowing an unauthenticated attacker to forge…
LiteLLM /config/update Broken Access Control (CVE-2026-35029)
LiteLLM's /config/update endpoint does not check the caller's role — any authenticated user holding a valid API key, not just a proxyadmin, can modify the proxy's runtime configuration. This allows registering a malicious pass-through endpoint that can be…
Authenticated Command Injection in LiteLLM MCP Test Endpoints (CVE-2026-42271)
CVE-2026-42271 is a command injection vulnerability in BerriAI LiteLLM's MCP preview/test endpoints — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list. These endpoints accept a full MCP server configuration in the request body, including…