LiteLLM vulnerabilities and CVEs
The Beam CVE database tracks 41 security advisories for LiteLLM: 7 critical, 17 high, 8 medium and 9 low severity. 3 are known to be exploited (CISA KEV). The newest is CVE-2026-84377, published Sep 30, 2026 and fixed in 1.88.6, 1.89.7.
An LLM gateway and SDK that routes calls to many providers. The proxy often holds every provider key a team uses.
Check your version: pip show litellm
- Vulnerabilities tracked
- 41
- Critical
- 7
- Known exploited (CISA KEV)
- 3
- Published in the last 30 days
- 1
All entries, newest first
CVE-2026-84377
LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters
medium6.5Sep 30, 2026CVE-2026-59823
LiteLLM Proxy has server-side request forgery via the `user_config` request parameter
medium5.3Sep 17, 2026CVE-2026-37004
LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint
critical9.8Aug 27, 2026CVE-2026-59819
LiteLLM: Local file read via request-supplied OIDC file references
low2.1Jul 22, 2026CVE-2026-59820
LiteLLM: Arbitrary file write via path traversal in Skills archive extraction
medium6.1Jul 22, 2026CVE-2026-59821
LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
low2.1Jul 22, 2026CVE-2026-59822
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
high8.8ExploitedJul 22, 2026CVE-2026-12770
LiteLLM: Admin Key Handler Has Improper Authorization
low5.4No fixJun 21, 2026CVE-2026-12771
LiteLLM: M2M JWT Handler Has Improper Authorization
low5.0No fixJun 21, 2026CVE-2026-12772
LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration
low6.3No fixJun 21, 2026CVE-2026-12773
LiteLLM: MCP Proxy Has Improper Authentication
medium7.3Jun 21, 2026CVE-2026-12795
LiteLLM: SSO Debug Flow Has Improper Authentication
medium7.3No fixJun 21, 2026CVE-2026-12796
BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens
low6.3No fixJun 21, 2026CVE-2026-12797
BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints
low6.3No fixJun 21, 2026CVE-2026-12798
BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader
low6.3No fixJun 21, 2026CVE-2026-12799
BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure
low4.3No fixJun 21, 2026CVE-2026-49468
LiteLLM: Authentication Bypass via Host Header Injection
critical9.8Jun 16, 2026CVE-2026-47101
LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit
high8.8May 21, 2026CVE-2026-47102
LiteLLM allows a user to modify their own user_role via the /user/update endpoint
high8.8May 21, 2026CVE-2026-40217
LiteLLM has a sandbox escape in custom-code guardrail
high8.8May 11, 2026CVE-2026-42271
LiteLLM: Authenticated command execution via MCP stdio test endpoints
high8.8ExploitedApr 25, 2026CVE-2026-42203
LiteLLM: Server-Side Template Injection in /prompts/test endpoint
high8.6Apr 24, 2026CVE-2026-42208
LiteLLM has SQL Injection in Proxy API key verification
critical9.8ExploitedApr 24, 2026GHSA-69x8-hrgq-fjj8
LiteLLM: Password hash exposure and pass-the-hash authentication bypass
high8.6Apr 8, 2026CVE-2026-35029
LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint
high8.7Apr 3, 2026CVE-2026-35030
LiteLLM: Authentication bypass via OIDC userinfo cache key collision
critical9.4Apr 3, 2026GHSA-5mg7-485q-xm76
Two LiteLLM versions published containing credential harvesting malware
criticalNo fixMar 25, 2026CVE-2024-10188
LiteLLM Vulnerable to Denial of Service (DoS)
high7.5Mar 20, 2025CVE-2024-6825
LiteLLM Vulnerable to Remote Code Execution (RCE)
high8.8No fixMar 20, 2025CVE-2024-8984
LiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP Request
high7.5Mar 20, 2025CVE-2024-9606
LiteLLM Reveals Portion of API Key via a Logging File
high7.5Mar 20, 2025CVE-2025-0330
LiteLLM Has a Leakage of Langfuse API Keys
high7.5No fixMar 20, 2025CVE-2025-0628
LiteLLM Has an Improper Authorization Vulnerability
high8.1Mar 20, 2025CVE-2024-6587
LiteLLM Server-Side Request Forgery (SSRF) vulnerability
high7.5Sep 13, 2024CVE-2024-5710
litellm vulnerable to improper access control in team management
medium5.3Jun 27, 2024CVE-2024-5751
litellm vulnerable to remote code execution based on using eval unsafely
critical9.8Jun 27, 2024CVE-2024-4888
Arbitrary file deletion in litellm
high6.5Jun 6, 2024CVE-2024-4890
SQL injection in litellm
medium4.9No fixJun 6, 2024CVE-2024-5225
SQL injection in litellm
medium6.4Jun 6, 2024CVE-2024-4264
litellm passes untrusted data to `eval` function without sanitization
high7.2No fixMay 18, 2024CVE-2024-2952
LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint
critical9.8Apr 10, 2024