BerriAI litellm
31 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-114612 | >= 1.87.0, < 1.100.4 ; >= 1.101.0, < 1.101.3 ; >= 1.102.0, < 1.102.2 ; … | LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key | CRITICAL 9.9 | 0.3 % | ||
| CVE-2026-108575 | 1.0 ; 1.1 ; 1.2 ; … | BerriAI LiteLLM Secret Resolution main.py get_secret improper authorization | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-108574 | 1.0 ; 1.1 ; 1.2 ; … | BerriAI LiteLLM Spend Tracking spend_management_endpoints.py ui_view_session_spend_logs authorization | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-93355 | ≤ 1.102.1 ; ≤ f4308bc124eebc783dfc51790ce8db27ed21ae00 | LiteLLM Weak JWT Authentication via Email-Based User Lookup | HIGH 7.6 | 0.3 % | ||
| CVE-2026-89032 | < 1.101.0-rc.1 | BerriAI LiteLLM < 1.101.0-rc.1 Tenant Isolation Bypass via Semantic Cache Layer | HIGH 8.7 | 0.3 % | ||
| CVE-2026-59823 | < 1.83.9 | LiteLLM: Server-side request forgery via the `user_config` request parameter in LiteLLM Proxy | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-84377 | < 1.88.6 ; >= 1.89.0, < 1.96.2 | LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-59819 | < 1.83.10-stable | LiteLLM: Local file read via request-supplied OIDC file references | LOW 2.1 | 0.6 % | ||
| CVE-2026-59822 | < 1.84.0 | LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback | HIGH 8.8 | 0.8 % | KEV | |
| CVE-2026-59820 | < 1.83.7-stable | LiteLLM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | MEDIUM 6.1 | 0.6 % | ||
| CVE-2026-59821 | < 1.82.0-stable | LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks | LOW 2.1 | 0.9 % | ||
| CVE-2026-49468 | < 1.84.0 | LiteLLM: Authentication Bypass via Host Header Injection | CRITICAL 9.5 | 3.0 % | ||
| CVE-2026-12799 | 1.82.0 ; 1.82.1 ; 1.82.2 | BerriAI litellm Incomplete Fix CVE-2025-0628 internal_user_endpoints.py ui_view_users improper authorization | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-12798 | 1.82.0 ; 1.82.1 ; 1.82.2 | BerriAI litellm MCP OpenAPI Spec Loader openapi_to_mcp_generator.py load_openapi_spec_async server-side request forgery | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-12797 | 1.82.0 ; 1.82.1 ; 1.82.2 ; … | BerriAI litellm Completions banned_keywords.py async_pre_call_hook authorization | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-12796 | 1.82.0 ; 1.82.1 ; 1.82.2 | BerriAI litellm SSO Authentication Flow ui_sso.py get_redirect_response_from_openid session expiration | MEDIUM 5.3 | 0.6 % | ||
| CVE-2026-12795 | 1.82.0 ; 1.82.1 ; 1.82.2 | BerriAI litellm SSO Debug Flow ui_sso.py json.dumps missing authentication | MEDIUM 6.9 | 0.8 % | ||
| CVE-2026-12774 | 1.82.0 ; 1.82.1 ; 1.82.2 | BerriAI litellm MCP Server Connection Testing rest_endpoints.py _execute_with_mcp_client server-side request forgery | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-12773 | 1.59.0 ; 1.59.1 ; 1.59.2 ; … | BerriAI litellm MCP Proxy user_api_key_auth_mcp.py UserAPIKeyAuth improper authentication | MEDIUM 6.9 | 1.0 % | ||
| CVE-2026-12772 | 1.82.0 ; 1.82.1 ; 1.82.2 | BerriAI litellm PROXY_ADMIN database API Key Generator login_utils.py authenticate_user session expiration | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-12771 | 1.82.0 ; 1.82.1 ; 1.82.2 | BerriAI litellm M2M JWT user_api_key_auth.py improper authorization | LOW 2.3 | 0.4 % | ||
| CVE-2026-12770 | 1.63.0 ; 1.63.1 | BerriAI litellm Admin Key key_management_endpoints.py improper authorization | MEDIUM 5.3 | 0.6 % | ||
| CVE-2026-47102 | < 1.83.10 | LiteLLM < 1.83.10 Privilege Escalation via User Update | HIGH 8.7 | 0.7 % | ||
| CVE-2026-47101 | < 1.83.14 | LiteLLM < 1.83.14 Privilege Escalation via API Key Generation | HIGH 8.7 | 1.2 % | ||
| CVE-2026-42208 | >= 1.81.16, < 1.83.7 | LiteLLM: SQL injection in Proxy API key verification | CRITICAL 9.3 | 89 % | KEV | |
| CVE-2026-42203 | >= 1.80.5, < 1.83.7 | LiteLLM: Server-Side Template Injection in /prompts/test endpoint | HIGH 8.6 | 0.4 % | ||
| CVE-2026-42271 | >= 1.74.2, < 1.83.7 | LiteLLM: Authenticated command execution via MCP stdio test endpoints | HIGH 8.7 | 91 % | KEV | |
| CVE-2026-40217 | bb0639701796218a3447160e55c0f1097446e4e6085df7dfd39f476d4143743f | LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI. | HIGH 8.8 | 16 % | ||
| CVE-2026-35030 | < 1.83.0 | LiteLLM has an authentication bypass via OIDC userinfo cache key collision | CRITICAL 9.4 | 0.6 % | ||
| CVE-2026-35029 | < 1.83.0 | LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint | HIGH 8.7 | 39 % | ||
| CVE-2026-33634 | >= 1.82.7, <= 1.82.8 | Trivy ecosystem supply chain briefly compromised | CRITICAL 9.4 | 60 % | KEV |