AI agent vulnerability · LiteLLM

CVE-2025-0330: LiteLLM Has a Leakage of Langfuse API Keys

highCVSS 3.0 7.5GHSA-879v-fggm-vxw2

In berriai/litellm version v1.52.1, an issue in proxyserver.py causes the leakage of Langfuse API keys when an error occurs while parsing team settings. This vulnerability exposes sensitive information, including langfusesecret and langfusepublickey, which can provide full access to the Langfuse project storing all requests.

Published Mar 20, 2025

Affected packages

litellm

Ecosystem: PyPI
Affected: <= 1.52.1
Fixed in: No patched version yet
Check: pip show litellm

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error occurs while parsing team settings. This vulnerability exposes sensitive information, including langfuse_secret and langfuse_public_key, which can provide full access to the Langfuse project storing all requests.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More LiteLLM vulnerabilities

All LiteLLM entries