EUVD-2026-96885
GHSA-gw95-8pcg-7gvv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege proxy access
-
ExploitSend request manipulating api_key argument
-
ExecutionTrigger improper authorization in get_secret
-
ImpactResolve/misuse protected secret
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privilege account on a LiteLLM deployment (CVSS PR:L), and the attacker must be able to reach and influence the api_key argument processed by the get_secret secret-resolution path in secret_managers/main.py. Exploitation is limited to deployments that expose LiteLLM's secret-resolution functionality to non-trusted authenticated users (e.g. multi-tenant proxy setups up to version 1.94.0); single-user or trusted-operator installations face negligible exposure. No user interaction is needed (UI:N), but the privilege requirement and low impact meaningfully limit real-world risk. |
| Impact | This is a low-priority, high-noise finding despite the 'Authentication Bypass' tag. The CVSS 4.0 base score is only 2.1, reflecting network attack vector (AV:N) and low complexity (AC:L) but requiring existing low-level privileges (PR:L) and yielding only low confidentiality, integrity, and availability impact (VC:L/VI:L/VA:L) with no scope change to subsequent systems. The exploit maturity flag (E:P) confirms proof-of-concept code exists, consistent with the description's statement that the exploit was publicly disclosed. No EPSS score, SSVC decision, or CISA KEV listing is present in the input, so there is no evidence of active or automatable exploitation - this is publicly available exploit code exists, not active in-the-wild use. The report originates solely from VulDB, a source that frequently auto-generates low-severity entries, and the vendor did not respond to disclosure, so affected-version and root-cause details are not vendor-confirmed. Net assessment: a genuine but minor improper-authorization issue (CWE-285) requiring authentication; not an urgent patch priority, but worth remediating in environments running LiteLLM as a multi-tenant proxy where low-privilege users should not reach secret-resolution logic. |
| Exploit ScenarioDerived | An attacker who already holds low-privilege authenticated access to a LiteLLM proxy deployment sends a request that manipulates the api_key argument reaching the get_secret function in secret_managers/main.py, causing the secret-resolution logic to perform improper authorization. A public proof-of-concept exists, and because the attack vector is network-based with low complexity, exploitation is straightforward for any user who already has minimal access. The realistic payoff is limited (low confidentiality/integrity/availability impact), likely exposing or misusing a secret value rather than granting full compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Improper authorization in BerriAI LiteLLM through version 1.94.0 allows an authenticated low-privilege user to manipulate the api_key argument handled by get_secret() in secret_managers/main.py (Secret Resolution component), causing secrets to be resolved for credentials the caller should not be able to reference. Exploitation requires an authenticated account on a deployment that exposes LiteLLM's secret-resolution path to non-trusted users (multi-tenant proxy setups); confidentiality, integrity, and availability impact is assessed as low, and single-user or trusted-operator installations face negligible exposure. Publicly available exploit code exists, but no CISA KEV entry confirms active exploitation, and the vendor did not respond to the disclosure, so no fixed version has been confirmed.
RemediationAI
No vendor-released patch was identified at time of analysis: BerriAI was contacted early about the disclosure but did not respond, and no exact fixed version is confirmed in the available data, so there is nothing to upgrade to yet beyond tracking the upstream project for a release later than 1.94.0 and applying it as soon as it appears. Because public exploit code exists for this otherwise low-severity flaw, the practical priority is reducing reachability of the secret-resolution path: run the proxy in single-tenant/trusted-operator mode rather than exposing it to untrusted authenticated users, and disable or avoid external secret-manager integration (Vault, AWS/GCP/Azure secret managers) so that credentials live only in process environment variables - the trade-off is loss of dynamic rotation and centralized secret governance. Where secret-manager integration must stay enabled, harden the backend identity instead of the code path by applying least-privilege IAM/Vault policies so the LiteLLM service account can read only the specific keys its configured models require, which limits blast radius but will break any model that expects additional dynamic secrets. Additionally, restrict low-privilege virtual keys and team/org scopes so only trusted administrative roles can supply or influence api_key references in configuration, and alert on anomalous secret-resolution events and unexpected outbound calls to the secret backend; this constrains the attack surface but requires reviewing existing multi-tenant key/team assignments, which may disrupt legitimate users. Consult https://vuldb.com/vuln/416232 and https://vuldb.com/cve/CVE-2026-108575 for updates on a fixed release.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
LiteLLM is a Python library and OpenAI-compatible proxy that fronts more than a hundred LLM providers, and it ships a secret-resolution layer (secret_managers/main.py) that turns credential references in configuration into real API keys held in backends such as HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, or Google Secret Manager. In this component the get_secret() function resolves a supplied api_key reference without verifying that the calling context is entitled to that secret, which is classified as CWE-285 (Improper Authorization) - the authorization check on the caller/identifier pair is missing or bypassable rather than the cryptography or memory handling being at fault. Because the secret-resolution path is reachable through the proxy request flow (CVSS AV:N) and only requires a low-privilege authenticated session (PR:L), any multi-tenant deployment where virtual keys, teams, or ordinary users can influence the api_key value passed into configuration handling exposes the resolution logic. The affected product is described by the wildcard CPE cpe:2.3:a:berriai:litellm:*:*:*:*:*:*:*:*, which reflects that the entire LiteLLM package lineage is in scope for the CPE dictionary and does not itself draw a patched/unpatched boundary; the version boundary comes from the vendor-independent report placing the flaw at 1.94.0 and below. No user interaction is needed, but the privilege prerequisite and the low integrity/confidentiality/availability ratings per the independent assessment keep the realistic impact contained to unauthorized resolution or mismanagement of secrets within an already-authenticated tenant boundary.
Know when Litellm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable with low complexity but needs an authenticated low-privilege account (PR:L); improper authorization yields only limited secret exposure/misuse, so C/I/A are all Low.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been found in BerriAI LiteLLM up to 1.94.0. This affects the function get_secret of the file secret_managers/main.py of the component Secret Resolution. The manipulation of the argument api_key leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote command execution in LiteLLM proxy server versions 1.74.2 through 1.83.6 allows any authenticated user to execute
SQL injection in LiteLLM proxy server versions 1.81.16 through 1.83.6 allows unauthenticated remote attackers to read an
Authentication bypass in LiteLLM (BerriAI) proxy/AI Gateway before 1.84.0 lets a remote unauthenticated attacker reach M
BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint. Rated critical s
Remote code execution in BerriAI LiteLLM (all versions through 2026-04-08) enables authenticated attackers to execute ar
BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on t
Authentication bypass in the LiteLLM proxy lets any party who already holds a valid JWT issued by the configured externa
In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error oc
In berriai/litellm before version 1.44.12, the `litellm/litellm_core_utils/litellm_logging.py` file contains a vulnerabi
A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10. Rated high severity (CVSS
An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the `/global/spend/logs` en
A code injection vulnerability exists in the berriai/litellm application, version 1.34.6, due to the use of unvalidated
Exploit-DB