GHSA-879v-fggm-vxw2

LiteLLM Has a Leakage of Langfuse API Keys

En bref

Publiée: 2025-03-20 12:32 UTC
Mise à jour: 2026-09-10 03:50 UTC
CVE: CVE-2025-0330
Alias: PYSEC-2026-1543
CVSS_V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error occurs while parsing team settings. This vulnerability exposes sensitive information, including langfuse_secret and langfuse_public_key, which can provide full access to the Langfuse project storing all requests.

Paquets affectés

Paquet	Versions
PyPI · litellm	introduced 0, last affected 1.52.1

Références

https://nvd.nist.gov/vuln/detail/CVE-2025-0330 ADVISORY
https://github.com/BerriAI/litellm PACKAGE
https://huntr.com/bounties/661b388a-44d8-4ad5-862b-4dc5b80be30a WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database