EUVD-2026-96396
GHSA-fx43-jvpp-9x44
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to OpenLIT instance
-
DeliveryObtain victim project id and DB config id
-
ExploitForge x-openlit-project-id header on trace read API
-
ExecutionReceive cross-tenant traces
-
ImpactExfiltrate LLM prompts and completions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a valid authenticated account on the target OpenLIT 2.1.0 instance (PR:L) and, critically, prior knowledge of both the victim's project id and the corresponding database config id (the AT:P attack requirement). Exploitation is performed by supplying a forged x-openlit-project-id header to the trace read API, which fails to re-check that the authenticated caller actually owns the referenced project. Limiting factors: this is only meaningful in multi-tenant/shared deployments where projects belong to different trust boundaries; a single-tenant or single-user installation has no victim to cross over to, and the need to discover two valid identifiers constrains opportunistic exploitation. Impact is limited to reading telemetry (prompts/completions) - no write, modification, or availability effect. |
| Impact | This is a medium-severity confidentiality issue (CVSS 4.0 base 6.0) rather than a top-tier emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N) is internally consistent with the description: it is network-reachable and low-complexity, but requires existing authentication (PR:L) and carries an Attack Requirement (AT:P) reflecting that the attacker must already know the victim's project id and database config id. Impact is confidentiality-only (VC:H, no integrity or availability impact), which matches a telemetry read primitive that exposes LLM prompts and completions. No EPSS score was provided, there is no CISA KEV listing (KEV=NO), and no public exploit code is flagged in the input - though a detailed technical write-up (hackmd) and a VulnCheck advisory with source-line pointers exist, which materially lower the research barrier even if they are not packaged exploit code. The key moderating signals are the authentication requirement and the AT:P prerequisite of knowing two identifiers; these prevent trivial opportunistic mass exploitation and place this below internet-facing unauthenticated RCE/data-leak bugs in priority. Net: a real, credible data-exposure flaw worth patching promptly in multi-tenant OpenLIT deployments, but not a drop-everything issue absent evidence of active exploitation. |
| Exploit ScenarioDerived | An authenticated user of a shared/multi-tenant OpenLIT 2.1.0 instance who has learned another tenant's project id and database config id sends a request to the trace read API with a forged x-openlit-project-id header matching the victim. Because authorization is not re-validated against the authenticated user's own project ownership, the backend returns the victim project's traces, including sensitive LLM prompts and completions. No weaponized exploit is required beyond crafting the HTTP header, and a public technical write-up documents the exact code paths. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Authenticated users of OpenLIT 2.1.0 can read telemetry belonging to other projects - including captured LLM prompts and completions - by forging the x-openlit-project-id header against the trace read API, because the server trusts the client-supplied project identifier without re-checking that the caller actually owns the referenced project. Exploitation requires a valid account on the target instance plus prior knowledge of both the victim's project id and its corresponding database config id, which restricts meaningful impact to multi-tenant or shared deployments where projects cross trust boundaries; a single-tenant installation has no cross-tenant victim to reach. The effect is confidentiality-only (no modification or availability impact), and no public exploit code or confirmed active exploitation (no CISA KEV listing) was identified at time of analysis, so this is assessed as a medium-severity authorization bypass rather than an emergency.
RemediationAI
No vendor-released patch was identified at time of analysis, so remediation currently depends on compensating controls and on tracking the upstream project at https://github.com/openlit/openlit for a fixed release that re-binds the project context to the authenticated session. Until then, the most direct control is to add or enforce a server-side ownership check on the trace read API so that the project id (and the database config id) supplied in the x-openlit-project-id header must match a project owned by the authenticated caller - the code paths to change are src/client/src/middleware/check-auth.ts and src/client/src/lib/telemetry-source.ts as shown in the references; self-patching the source is feasible for self-hosted users but must be re-applied on upgrade. Where patching is not possible, run OpenLIT in single-tenant mode or isolate each tenant on its own instance/namespace, which removes the cross-tenant victim entirely but costs infrastructure and complicates centralized observability. Additionally, restrict network access to the trace read API to trusted management networks or an authenticating reverse proxy (reduces exposure to any authenticated-but-untrusted tenant user, at the cost of blocking legitimate remote dashboards), and treat project ids together with database config ids as sensitive identifiers - rotate or avoid exposing them in URLs, logs, and UI responses - since knowledge of both is the practical prerequisite documented for this attack. Monitor access logs for trace read requests where the x-openlit-project-id does not match the caller's own project as a detection signal. See https://www.vulncheck.com/advisories/openlit-2.1.0-authorization-bypass-via-x-openlit-project-id-header and https://hackmd.io/@haind/openlit-project-context-read for the published technical details used above.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-639, Authorization Bypass Through User-Controlled Key: OpenLIT derives the active project context from a request header (x-openlit-project-id) rather than from the authenticated session's own project binding. Two code paths matter - the auth middleware (src/client/src/middleware/check-auth.ts, lines 22-33) validates that a caller is authenticated but does not bind the requested project to that caller, and the telemetry source resolver (src/client/src/lib/telemetry-source.ts, lines 113-125) uses the supplied project id together with a database config id to select which telemetry store is queried. OpenLIT is an OpenTelemetry-oriented LLM observability platform, so the data exposed through the trace read API is not just generic logs but the semantic content of LLM traffic (prompts, completions, and associated trace metadata), which can itself contain sensitive user input, proprietary context, or secrets embedded in prompts. Per the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), the attack is network-reachable but high complexity, because the attacker must already hold a valid account (PR:L) and must supply two valid identifiers - the victim project id and the associated database config id - which functions as an attack-precondition (AT:P in the CVSS 4.0 vector). No write primitive, injection, or privilege escalation is involved; the weakness is purely a missing object-level authorization check on an identifier the client controls.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Authenticated user so PR:L; needing to know the victim project id and DB config id raises AC:H (no 3.1 AT metric); confidentiality-only telemetry read gives C:H, I:N, A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
OpenLIT 2.1.0 contains an authorization bypass vulnerability that allows authenticated users to read other projects' telemetry by supplying a forged x-openlit-project-id header. Attackers who know a victim project id and database config id can query the trace read API to obtain traces including LLM prompts and completions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB