LiteLLM
Filed as: litellm
Records
50
Disclosed CVEs
49
Exploited (sev 3–4)
1
CISA KEV flagged
0
Newest record 2026-10-11 · 47 distinct CVE ids · open in the explorer (the explorer matches the first product a record names, so it can list fewer)
Patch now: confirmed exploitation or KEV · 1
Records at severity 3–4 (exploitation confirmed by CISA, the vendor or reporting) and records flagged as listed in CISA KEV. The KEV flag is the classifier’s cisa-kev tag or a source on the KEV catalog; it is recorded when the collector sees the listing, so a missing flag does not mean a CVE is absent from the catalog.
- 2026-03-25LiteLLM Releases Contain Credential Harvesting Malware3 Exploitedsupply_chain · malware · credential_harvesting
Disclosures by month · last 24 months
▄ ▁ ▁ ▆▁█▄▁▃▁
Nov ’2441 disclosed · peak 11 in Jun ’26Oct ’26
Disclosed CVEs, no confirmed exploitation · 49
- 2026-10-11CVE-2026-108575CVE-2026-108575: Improper authorization flaw in BerriAI LiteLLM secret resolution2 Disclosedlitellm · improper-authorization
- 2026-10-11CVE-2026-108574CVE-2026-108574: Authorization bypass flaw in BerriAI LiteLLM2 Disclosedlitellm · authorization-bypass
- 2026-09-28CVE-2026-93355CVE-2026-93355: LiteLLM Weak JWT Authentication Vulnerability2 Disclosedlitellm · jwt · authentication_bypass
- 2026-09-25CVE-2026-89032CVE-2026-89032: BerriAI LiteLLM semantic cache tenant isolation bypass2 Disclosedlitellm · cache-poisoning
- 2026-09-16
- 2026-09-02CVE-2026-84377CVE-2026-84377: LiteLLM Authenticated SSRF and Credential Exfiltration2 Disclosedlitellm · ssrf · credential_exfiltration
- 2026-08-27CVE-2026-37004CVE-2026-37004: LiteLLM server-side template injection in the test endpoint2 Disclosedssti · litellm
- 2026-07-15
- 2026-07-08CVE-2026-59819CVE-2026-59819: LiteLLM Local File Read Vulnerability2 Disclosedlitellm · local-file-read
- 2026-07-08CVE-2026-59821CVE-2026-59821: LiteLLM Custom Code Guardrails Bypass Sandboxing2 Disclosedlitellm · rce · guardrail_bypass
- 2026-07-08CVE-2026-59820CVE-2026-59820: LiteLLM Arbitrary File Write via Skills Archive2 Disclosedlitellm · path-traversal
- 2026-07-08CVE-2026-59822CVE-2026-59822: LiteLLM MCP authentication bypass via OAuth2 fallback2 Disclosedauth-bypass
- 2026-06-21
- 2026-06-21CVE-2026-12795CVE-2026-12795: LiteLLM SSO Debug Flow Authentication Bypass Vulnerability2 Disclosedlitellm
- 2026-06-21CVE-2026-12770CVE-2026-12770: LiteLLM Admin Key Handler Improper Authorization Vulnerability2 Disclosedlitellm
- 2026-06-21CVE-2026-12796CVE-2026-12796: BerriAI LiteLLM SSO Login Fails to Invalidate Previous Session Tokens2 Disclosedlitellm · sso
- 2026-06-21CVE-2026-12772CVE-2026-12772: LiteLLM API Key Generator Has Insufficient Session Expiration2 Disclosedlitellm · session-management
- 2026-06-21
- 2026-06-21CVE-2026-12797CVE-2026-12797: LiteLLM Has Security Feature Bypass in Guardrails2 Disclosedlitellm · guardrails
- 2026-06-21CVE-2026-12799CVE-2026-12799: LiteLLM UI User Enumeration Leads to Information Disclosure2 Disclosedlitellm · information-disclosure
- 2026-06-21CVE-2026-12771CVE-2026-12771: LiteLLM M2M JWT Handler Has Improper Authorization2 Disclosedlitellm · authorization
- 2026-06-21CVE-2026-12798CVE-2026-12798: BerriAI litellm SSRF via spec_path URL loader2 Disclosedssrf · infra_vuln
- 2026-06-16CVE-2026-49468CVE-2026-49468: LiteLLM Authentication Bypass via Host Header Injection2 Disclosedhost-header-injection · auth-bypass
- 2026-05-21CVE-2026-47101LiteLLM API Key Generation Flaw Allows Unauthorized Route Access2 Disclosedprivilege-escalation · litellm
- 2026-05-21CVE-2026-47102LiteLLM User Role Update Vulnerability Enables Privilege Escalation2 Disclosedprivilege-escalation · litellm
- 2026-04-25CVE-2026-42271CVE-2026-42271: LiteLLM Authenticated Command Execution via MCP Endpoints2 Disclosedcommand_injection · mcp
- 2026-04-24
- 2026-04-24CVE-2026-42208CVE-2026-42208: LiteLLM proxy API key verification SQL injection2 Disclosedsql-injection
- 2026-04-10CVE-2026-40217CVE-2026-40217: LiteLLM sandbox escape in custom-code guardrail2 Disclosedsandbox-escape · rce
- 2026-04-10LiteLLM sandbox escape vulnerability in custom-code guardrail2 Disclosedghsa-3926-2jvf-fg29 · rce · sandbox-escape
- 2026-04-08LiteLLM authentication bypass and password hash exposure2 Disclosedghsa-69x8-hrgq-fjj8 · auth-bypass · hash-exposure
- 2026-04-03CVE-2026-35030CVE-2026-35030: LiteLLM authentication bypass via OIDC cache collision2 Disclosedauth-bypass · oidc
- 2026-04-03CVE-2026-35029CVE-2026-35029: LiteLLM proxy configuration endpoint privilege escalation2 Disclosedrce · privilege-escalation
- 2025-10-29CVE-2025-11203CVE-2025-11203: LiteLLM information disclosure vulnerability in health endpoint2 Disclosedinformation-disclosure · litellm
- 2025-07-03CVE-2025-45809CVE-2025-45809: SQL injection vulnerability in BerriAI LiteLLM2 Disclosedsql-injection · litellm
- 2025-03-20
- 2025-03-20CVE-2025-0330CVE-2025-0330: LiteLLM Langfuse API Key Leakage2 Disclosedlitellm · langfuse · credential-leak
- 2025-03-20CVE-2024-9606CVE-2024-9606: LiteLLM reveals portion of API key via logging file2 Disclosedapi-key-leak · logging
- 2025-03-20CVE-2024-8984CVE-2024-8984: LiteLLM Denial of Service via Crafted HTTP Request2 Disclosedlitellm · dos
- 2025-03-20CVE-2025-0628CVE-2025-0628: LiteLLM Improper Authorization and Privilege Escalation2 Disclosedprivilege-escalation · litellm
- 2025-03-20CVE-2024-6825CVE-2024-6825: LiteLLM Vulnerable to Remote Code Execution via Rules2 Disclosedrce · litellm
- 2024-09-13CVE-2024-6587CVE-2024-6587: LiteLLM Server-Side Request Forgery vulnerability2 Disclosedssrf · litellm
- 2024-06-27CVE-2024-5710CVE-2024-5710: Improper access control in litellm team management2 Disclosedaccess-control
- 2024-06-27
- 2024-06-06CVE-2024-4890CVE-2024-4890: SQL Injection Vulnerability in LiteLLM2 Disclosedsql-injection · litellm
- 2024-06-06
- 2024-06-06
- 2024-05-18CVE-2024-4264CVE-2024-4264: LiteLLM Unsafe Eval Remote Code Execution2 Disclosedrce · eval-injection
- 2024-04-10CVE-2024-2952LiteLLM Server-Side Template Injection in Completions Endpoint2 Disclosedssti · litellm
This page lists what has been reported, not what to do about it. Versions and fixes are in each linked advisory; check the vendor’s own advisory before acting.