Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · LiteLLM

CVE-2024-5710: litellm vulnerable to improper access control in team management

mediumCVSS 3.1 5.3GHSA-qqcv-vg9f-5rr3

berriai/litellm version 1.34.34 is vulnerable to improper access control in its team management functionality. This vulnerability allows attackers to perform unauthorized actions such as creating, updating, viewing, deleting, blocking, and unblocking any teams, as well as adding or deleting any member to or from any teams.

Published Jun 27, 2024 · Updated Mar 25, 2026

Affected packages

litellm

Ecosystem
PyPI
Affected
< 1.40.15
Fixed in
1.40.15
Check
pip show litellm

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

berriai/litellm version 1.34.34 is vulnerable to improper access control in its team management functionality. This vulnerability allows attackers to perform unauthorized actions such as creating, updating, viewing, deleting, blocking, and unblocking any teams, as well as adding or deleting any member to or from any teams. The vulnerability stems from insufficient access control checks in various team management endpoints, enabling attackers to exploit these functionalities without proper authorization.

Credited to byt3bl33d3r.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More LiteLLM vulnerabilities

All LiteLLM entries