CVE-2024-9606: LiteLLM Reveals Portion of API Key via a Logging File
In berriai/litellm before version 1.44.12, the litellm/litellmcoreutils/litellmlogging.py file contains a vulnerability where the API key masking code only masks the first 5 characters of the key. This results in the leakage of almost the entire API key in the logs, exposing a significant amount of the secret key. The issue affects version v1.44.9.
Published Mar 20, 2025
Affected packages
litellm
- Ecosystem
- PyPI
- Affected
- < 1.44.12
- Fixed in
- 1.44.12
- Check
pip show litellm
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
In berriai/litellm before version 1.44.12, the litellm/litellm_core_utils/litellm_logging.py file contains a vulnerability where the API key masking code only masks the first 5 characters of the key. This results in the leakage of almost the entire API key in the logs, exposing a significant amount of the secret key. The issue affects version v1.44.9.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More LiteLLM vulnerabilities
All LiteLLM entriesCVE-2026-84377
LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters
medium6.5Sep 30, 2026CVE-2026-59823
LiteLLM Proxy has server-side request forgery via the `user_config` request parameter
medium5.3Sep 17, 2026CVE-2026-37004
LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint
critical9.8Aug 27, 2026CVE-2026-59819
LiteLLM: Local file read via request-supplied OIDC file references
low2.1Jul 22, 2026CVE-2026-59820
LiteLLM: Arbitrary file write via path traversal in Skills archive extraction
medium6.1Jul 22, 2026CVE-2026-59821
LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
low2.1Jul 22, 2026