Is there a public PoC exploit available for CVE-2026-12770?

Yes, a public proof-of-concept exploit is available for CVE-2026-12770. Prioritise patching immediately. EPSS: 0.2%.

BerriAI LiteLLM CVE-2026-12770

Q: What is the CVSS score of CVE-2026-12770?

CVE-2026-12770 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38136 LOW

Improper Authorization (CWE-285)

2026-06-21 VulDB

GHSA-6qr3-3g89-m4jj

Authentication Bypass Litellm Berriai

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-accessible proxy requires authenticated API key (PR:L); no confidentiality impact since keys are not exposed, only blocked or budget-modified.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 22, 2026 - 06:28 vuln.today

Analysis Generated

Jun 22, 2026 - 06:28 vuln.today

Severity Changed

Jun 21, 2026 - 01:52 NVD

MEDIUM LOW

CVSS changed

Jun 21, 2026 - 01:52 NVD

5.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was determined in BerriAI litellm up to 1.63.1. The impacted element is an unknown function of the file litellm/proxy/management_endpoints/key_management_endpoints.py of the component Admin Key Handler. This manipulation causes improper authorization. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

AnalysisAI

Improper authorization in BerriAI LiteLLM versions 1.63.0-1.63.1 allows any authenticated user - holding any valid API key regardless of role - to perform admin-restricted operations on other users' API keys, including blocking, unblocking, and modifying budget limits via the /key/block, /key/unblock, and /key/update endpoints. The root cause, confirmed by GitHub PR #23781, is the complete absence of access-control enforcement on these endpoints despite their admin-only documentation. A publicly available proof-of-concept exploit exists on GitHub; this vulnerability is not in the CISA KEV catalog at time of analysis.

Technical ContextAI

LiteLLM (CPE: cpe:2.3:a:berriai:litellm:*:*:*:*:*:*:*:*) is an open-source LLM proxy and API gateway implemented in Python using FastAPI. It manages API keys, per-key budget limits, and team/organization access controls through a management API layer. The vulnerable component is litellm/proxy/management_endpoints/key_management_endpoints.py, specifically the /key/block, /key/unblock endpoint handlers and the _validate_update_key_data function that processes max_budget updates. CWE-285 (Improper Authorization) describes the root cause precisely: these endpoints were designed and documented as admin-only operations, but no runtime authorization check was invoked before executing the privileged action. The PR #23781 fix introduces _check_key_admin_access(), which queries the database for the target key's team membership and then verifies the calling user holds one of three elevated roles - proxy admin, team admin for the key's team, or org admin for that team's organization - before allowing the operation to proceed.

RemediationAI

The upstream fix is available as GitHub PR #23781 (https://github.com/BerriAI/litellm/pull/23781), which adds the _check_key_admin_access() authorization guard to the /key/block, /key/unblock, and /key/update (max_budget) endpoints. A specific released patched version number has not been independently confirmed from available data - operators should monitor the BerriAI LiteLLM release feed and apply the first tagged release that incorporates PR #23781. As compensating controls prior to patching: restrict network access to the LiteLLM proxy management API to trusted administrator IP ranges using firewall or reverse-proxy ACLs (this limits exposure but may disrupt legitimate remote team-level key management workflows); alternatively, if the block/unblock functionality is not operationally required, disable those endpoints in the proxy configuration to eliminate that attack surface entirely. Budget-manipulation via /key/update cannot be blocked without disabling the broader update endpoint, which has wider operational impact.