EUVD-2026-38156
GHSA-p897-vf7j-f5h8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low-privileged network authentication required; scope unchanged; no availability impact from a content-filter bypass; confidentiality and integrity limited by the hook's position in the request pipeline.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in BerriAI litellm up to 1.82.5. Affected is the function async_pre_call_hook of the file enterprise/enterprise_hooks/banned_keywords.py of the component Completions Interface. The manipulation of the argument prompt results in incorrect authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.
AnalysisAI
Incorrect authorization in BerriAI LiteLLM's enterprise banned keywords hook allows remote low-privileged authenticated users to bypass prompt content filtering by manipulating the prompt argument to the async_pre_call_hook function in enterprise/enterprise_hooks/banned_keywords.py. All versions in the 1.82.x series up to and including 1.82.5 are confirmed affected. A public proof-of-concept exploit is available via GitHub Gist, materially increasing the risk for enterprise deployments that rely on the banned keywords feature as a compliance or safety enforcement boundary; no confirmed CISA KEV listing exists at time of analysis.
Technical ContextAI
LiteLLM is a Python-based LLM proxy and unified API layer that routes requests to multiple upstream large language model providers. Its enterprise edition includes a hook-based middleware pipeline for pre-call processing; enterprise/enterprise_hooks/banned_keywords.py implements an asynchronous hook (async_pre_call_hook) designed to inspect incoming prompt content and reject requests containing prohibited terms before forwarding them to the LLM backend. CWE-863 (Incorrect Authorization) identifies the root cause: the access control decision governing whether a prompt is permitted or blocked is made incorrectly - likely because the hook evaluates a different representation of the prompt than what is ultimately dispatched, or the authorization check can be skipped via parameter manipulation. The affected CPE is cpe:2.3:a:berriai:litellm:*:*:*:*:*:*:*:*, with EUVD-2026-38156 narrowing the confirmed range to the 1.82.x release train.
RemediationAI
No vendor-released patched version has been independently confirmed at time of analysis - the VulDB submission (https://vuldb.com/submit/811288) notes early vendor contact but no fix version appears in any available reference. Operators should monitor the BerriAI LiteLLM GitHub repository and VulDB advisory page (https://vuldb.com/vuln/372559) for patch availability. As an immediate compensating control, disable or remove the banned_keywords enterprise hook from the middleware chain and migrate keyword enforcement to an upstream API gateway or reverse proxy that cannot be bypassed via prompt argument manipulation - this eliminates the vulnerable code path but fully disables in-LiteLLM keyword filtering. Alternatively, restrict Completions Interface access to a tightly scoped set of fully trusted authenticated users, reducing the population of principals who can attempt the bypass. If the hook must remain active, consider supplementing it with server-side prompt normalization (canonicalization of encoding and whitespace) before the hook evaluates content, which may reduce bypass surface while the vendor patch is pending.
SQL injection in LiteLLM proxy server versions 1.81.16 through 1.83.6 allows unauthenticated remote attackers to read an
Authentication bypass in LiteLLM (BerriAI) proxy/AI Gateway before 1.84.0 lets a remote unauthenticated attacker reach M
Remote command execution in LiteLLM proxy server versions 1.74.2 through 1.83.6 allows any authenticated user to execute
BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint. Rated critical s
Remote code execution in BerriAI LiteLLM (all versions through 2026-04-08) enables authenticated attackers to execute ar
BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on t
In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error oc
In berriai/litellm before version 1.44.12, the `litellm/litellm_core_utils/litellm_logging.py` file contains a vulnerabi
A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10. Rated high severity (CVSS
An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the `/global/spend/logs` en
A code injection vulnerability exists in the berriai/litellm application, version 1.34.6, due to the use of unvalidated
berriai/litellm version 1.34.34 is vulnerable to improper access control in its team management functionality. Rated med
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today