Berriai

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-59822	Authentication bypass in LiteLLM (BerriAI) proxy/AI Gateway before 1.84.0 lets a remote unauthenticated attacker reach MCP tooling by sending a fabricated Authorization header. The malformed header forces the MCP Streamable HTTP endpoint down an OAuth2 passthrough fallback that substitutes a failed key validation with an empty UserAPIKeyAuth() object, effectively treating the caller as authorized without any valid LiteLLM key. The CVSS 4.0 score of 8.8 reflects network-reachable, no-privilege access with high confidentiality impact; no public exploit identified at time of analysis and it is not listed in CISA KEV.	HIGH	8.8	0.3%	114	KEV PoC
CVE-2026-12773	Authentication bypass in BerriAI LiteLLM versions 1.59.0 through 1.59.8 allows unauthenticated remote attackers to circumvent the UserAPIKeyAuth function within the experimental MCP Proxy server component, gaining unauthorized access to protected LLM proxy functionality without valid credentials. A public proof-of-concept exploit is confirmed available via GitHub gist (YLChen-007), materially lowering the bar for exploitation. No CISA KEV listing is present at time of analysis, but the network-accessible, zero-authentication attack surface combined with an available PoC warrants urgent remediation prioritization for any deployment with the MCP server component exposed.	MEDIUM	5.5	0.4%	48	PoC
CVE-2026-12795	Missing authentication in LiteLLM's SSO Debug Flow exposes the `json.dumps` output of the `ui_sso.py` management endpoint to unauthenticated remote attackers, enabling authentication bypass against versions up to 1.82.2. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms this is network-exploitable with no privileges or user interaction required. A public proof-of-concept has been disclosed on GitHub, elevating practical risk beyond the moderate base score alone; no active exploitation has been confirmed by CISA KEV at the time of analysis.	MEDIUM	5.5	0.4%	48	PoC No patch
CVE-2026-84377	Credential exfiltration via SSRF in LiteLLM proxy (AI Gateway) prior to versions 1.88.6 and 1.96.2 allows any authenticated proxy user to redirect outbound LLM provider calls to an attacker-controlled endpoint, causing the proxy to transmit its operator-configured API keys and other secrets to that destination. Vulnerable routing parameters - api_base, base_url, model_list, fallbacks, and litellm_credential_name - could be injected through nested request fields, path values, and bracket-notation form data that incomplete validation across five proxy modules failed to intercept. No public exploit code has been identified at time of analysis; vendor-released patches are confirmed at versions 1.88.6 and 1.96.2.	MEDIUM	6.5	0.3%	33
CVE-2026-59820	Path traversal in LiteLLM's Skills archive extraction enables authenticated users with access to specific LLM API routes to write arbitrary files outside the intended server extraction directory by uploading a crafted ZIP archive containing path traversal entries. Affected versions are all LiteLLM releases prior to 1.83.7-stable; the CPE confirms the entire berriai/litellm product line is in scope. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the integrity and availability impact is rated High in the vendor-provided CVSS 4.0 vector, making this a meaningful risk for any LiteLLM deployment that exposes the Skills upload feature to untrusted authenticated users.	MEDIUM	6.1	0.3%	31
CVE-2026-12796	Insufficient session expiration in LiteLLM's SSO authentication flow exposes deployments running versions 1.82.0 through 1.82.2 to unauthorized persistent session access by low-privileged authenticated users. The flaw resides in the `get_redirect_response_from_openid` function within the OpenID Connect callback handling code, allowing manipulation of the SSO redirect response to bypass session lifetime enforcement. No confirmed active exploitation (not in CISA KEV), but a publicly available proof-of-concept exploit on GitHub lowers the barrier to abuse, and the CVSS 4.0 vector explicitly encodes the exploit availability modifier E:P.	LOW	2.1	0.3%	31	PoC No patch
CVE-2026-12770	Improper authorization in BerriAI LiteLLM versions 1.63.0-1.63.1 allows any authenticated user - holding any valid API key regardless of role - to perform admin-restricted operations on other users' API keys, including blocking, unblocking, and modifying budget limits via the `/key/block`, `/key/unblock`, and `/key/update` endpoints. The root cause, confirmed by GitHub PR #23781, is the complete absence of access-control enforcement on these endpoints despite their admin-only documentation. A publicly available proof-of-concept exploit exists on GitHub; this vulnerability is not in the CISA KEV catalog at time of analysis.	LOW	2.1	0.2%	31	PoC No patch
CVE-2026-12799	Improper authorization in BerriAI LiteLLM versions up to 1.82.2 allows authenticated low-privilege users to access user data beyond their permitted scope via the `ui_view_users` management endpoint - an incomplete remediation of the prior CVE-2025-0628 authorization bypass in the same function. A public proof-of-concept exploit is available on GitHub (YLChen-007), confirming practical exploitability. No active exploitation is confirmed (not in CISA KEV), and the authentication requirement (CVSS 4.0 PR:L) constrains the attacker pool to those already holding valid credentials on the target proxy.	LOW	2.1	0.2%	31	PoC No patch
CVE-2026-12772	Insufficient session expiration in LiteLLM's proxy authentication layer (versions 1.82.0 through 1.82.2) allows remote low-privileged users to reuse or manipulate session tokens generated by the PROXY_ADMIN API Key Generator beyond their intended validity window. The flaw resides in the `authenticate_user` function within `litellm/proxy/auth/login_utils.py`, where session/API key lifecycle management does not enforce expiration correctly per CWE-613. A public proof-of-concept exploit exists (GitHub gist), though no active exploitation has been confirmed via CISA KEV. The CVSS 4.0 score of 2.1 reflects a limited real-world blast radius despite the network-accessible attack vector.	LOW	2.1	0.2%	31	PoC No patch
CVE-2026-12774	Server-side request forgery in BerriAI LiteLLM versions up to 1.82.2 allows authenticated remote attackers to induce the proxy server to make arbitrary outbound HTTP requests by manipulating the MCP (Model Context Protocol) Server Connection Testing endpoint. The vulnerable function `_execute_with_mcp_client` in the experimental MCP server component fails to validate or restrict user-supplied connection targets, enabling internal network probing, potential access to cloud metadata services, and circumvention of network segmentation controls. A publicly available proof-of-concept exploit exists (GitHub gist by YLChen-007); no CISA KEV listing was present at time of analysis. The CVSS 4.0 reported score of 2.1 reflects threat-metric downgrade from E:P (proof-of-concept) and should not be taken as indicative of low inherent exploitability - the base network vector with low-privilege access represents a meaningful internal network exposure risk.	LOW	2.1	0.2%	31	PoC No patch
CVE-2026-12797	Incorrect authorization in BerriAI LiteLLM's enterprise banned keywords hook allows remote low-privileged authenticated users to bypass prompt content filtering by manipulating the `prompt` argument to the `async_pre_call_hook` function in `enterprise/enterprise_hooks/banned_keywords.py`. All versions in the 1.82.x series up to and including 1.82.5 are confirmed affected. A public proof-of-concept exploit is available via GitHub Gist, materially increasing the risk for enterprise deployments that rely on the banned keywords feature as a compliance or safety enforcement boundary; no confirmed CISA KEV listing exists at time of analysis.	LOW	2.1	0.2%	31	PoC No patch
CVE-2026-12798	Server-side request forgery in LiteLLM's experimental MCP OpenAPI Spec Loader allows authenticated remote attackers to coerce the server into issuing arbitrary HTTP requests by supplying a malicious `spec_path` value to the `load_openapi_spec_async` function. Affected versions are LiteLLM 1.82.0 through 1.82.2 as confirmed by EUVD. A public proof-of-concept exploit exists on GitHub, though the vulnerability is not in CISA KEV and the CVSS 4.0 score of 2.1 with E:P modifier reflects low-severity, authenticated exploitation with a known but apparently limited threat footprint.	LOW	2.1	0.2%	31	PoC No patch
CVE-2026-12771	Improper authorization in LiteLLM's M2M JWT Handler (litellm/proxy/auth/user_api_key_auth.py) enables remote attackers holding low-level credentials to bypass authorization controls in versions 1.82.0 through 1.82.2. The flaw resides in the machine-to-machine JWT authentication pathway of the LiteLLM proxy layer, where manipulated JWT inputs cause the handler to make incorrect authorization decisions, potentially granting unauthorized access to proxied LLM API resources. No active exploitation has been confirmed by CISA KEV, though publicly available exploit code exists (GitHub gist by YLChen-007), and the CVSS 4.0 vector carries an E:P temporal modifier reflecting this proof-of-concept availability; overall risk is tempered by high attack complexity.	LOW	1.3	0.2%	27	PoC No patch
CVE-2026-59821	Custom Code Guardrails in LiteLLM's AI Gateway proxy prior to 1.82.0-stable permitted privileged users with guardrail management rights to submit arbitrary Python code via the production create and update API paths, which executed unsandboxed within the proxy process. Unlike the test endpoint - which enforced sandbox controls - the production paths lacked equivalent validation, enabling the injected code to access and expose secrets, API keys, and environment variables available to the running process. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; risk is highest in multi-tenant or multi-operator LiteLLM deployments where guardrail management rights are distributed.	LOW	2.1	0.3%	11
CVE-2026-59819	Local filesystem read in LiteLLM's AI Gateway proxy prior to version 1.83.10-stable allows a proxy administrator to exfiltrate files from the server by supplying crafted oidc/file/ path references through the /health/test_connection endpoint. The vulnerability stems from unsanitized resolution of request-supplied environment and OIDC file references within litellm_params, giving a high-privileged caller a direct path to arbitrary file read. No public exploit code or active exploitation has been identified; the low CVSS 4.0 score of 2.1 reflects the high privilege bar and limited confidentiality impact.	LOW	2.1	0.3%	11

CVE-2026-59822

Authentication bypass in LiteLLM (BerriAI) proxy/AI Gateway before 1.84.0 lets a remote unauthenticated attacker reach MCP tooling by sending a fabricated Authorization header. The malformed header forces the MCP Streamable HTTP endpoint down an OAuth2 passthrough fallback that substitutes a failed key validation with an empty UserAPIKeyAuth() object, effectively treating the caller as authorized without any valid LiteLLM key. The CVSS 4.0 score of 8.8 reflects network-reachable, no-privilege access with high confidentiality impact; no public exploit identified at time of analysis and it is not listed in CISA KEV.

HIGH

8.8

0.3%

114

KEV PoC

CVE-2026-12773

Authentication bypass in BerriAI LiteLLM versions 1.59.0 through 1.59.8 allows unauthenticated remote attackers to circumvent the UserAPIKeyAuth function within the experimental MCP Proxy server component, gaining unauthorized access to protected LLM proxy functionality without valid credentials. A public proof-of-concept exploit is confirmed available via GitHub gist (YLChen-007), materially lowering the bar for exploitation. No CISA KEV listing is present at time of analysis, but the network-accessible, zero-authentication attack surface combined with an available PoC warrants urgent remediation prioritization for any deployment with the MCP server component exposed.

MEDIUM

5.5

0.4%

48

PoC

CVE-2026-12795

Missing authentication in LiteLLM's SSO Debug Flow exposes the `json.dumps` output of the `ui_sso.py` management endpoint to unauthenticated remote attackers, enabling authentication bypass against versions up to 1.82.2. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms this is network-exploitable with no privileges or user interaction required. A public proof-of-concept has been disclosed on GitHub, elevating practical risk beyond the moderate base score alone; no active exploitation has been confirmed by CISA KEV at the time of analysis.

MEDIUM

5.5

0.4%

48

PoC No patch

CVE-2026-84377

Credential exfiltration via SSRF in LiteLLM proxy (AI Gateway) prior to versions 1.88.6 and 1.96.2 allows any authenticated proxy user to redirect outbound LLM provider calls to an attacker-controlled endpoint, causing the proxy to transmit its operator-configured API keys and other secrets to that destination. Vulnerable routing parameters - api_base, base_url, model_list, fallbacks, and litellm_credential_name - could be injected through nested request fields, path values, and bracket-notation form data that incomplete validation across five proxy modules failed to intercept. No public exploit code has been identified at time of analysis; vendor-released patches are confirmed at versions 1.88.6 and 1.96.2.

MEDIUM

6.5

0.3%

33

CVE-2026-59820

Path traversal in LiteLLM's Skills archive extraction enables authenticated users with access to specific LLM API routes to write arbitrary files outside the intended server extraction directory by uploading a crafted ZIP archive containing path traversal entries. Affected versions are all LiteLLM releases prior to 1.83.7-stable; the CPE confirms the entire berriai/litellm product line is in scope. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the integrity and availability impact is rated High in the vendor-provided CVSS 4.0 vector, making this a meaningful risk for any LiteLLM deployment that exposes the Skills upload feature to untrusted authenticated users.

MEDIUM

6.1

0.3%

31

CVE-2026-12796

Insufficient session expiration in LiteLLM's SSO authentication flow exposes deployments running versions 1.82.0 through 1.82.2 to unauthorized persistent session access by low-privileged authenticated users. The flaw resides in the `get_redirect_response_from_openid` function within the OpenID Connect callback handling code, allowing manipulation of the SSO redirect response to bypass session lifetime enforcement. No confirmed active exploitation (not in CISA KEV), but a publicly available proof-of-concept exploit on GitHub lowers the barrier to abuse, and the CVSS 4.0 vector explicitly encodes the exploit availability modifier E:P.

LOW

2.1

0.3%

31

PoC No patch

CVE-2026-12770

Improper authorization in BerriAI LiteLLM versions 1.63.0-1.63.1 allows any authenticated user - holding any valid API key regardless of role - to perform admin-restricted operations on other users' API keys, including blocking, unblocking, and modifying budget limits via the `/key/block`, `/key/unblock`, and `/key/update` endpoints. The root cause, confirmed by GitHub PR #23781, is the complete absence of access-control enforcement on these endpoints despite their admin-only documentation. A publicly available proof-of-concept exploit exists on GitHub; this vulnerability is not in the CISA KEV catalog at time of analysis.

LOW

2.1

0.2%

31

PoC No patch

CVE-2026-12799

Improper authorization in BerriAI LiteLLM versions up to 1.82.2 allows authenticated low-privilege users to access user data beyond their permitted scope via the `ui_view_users` management endpoint - an incomplete remediation of the prior CVE-2025-0628 authorization bypass in the same function. A public proof-of-concept exploit is available on GitHub (YLChen-007), confirming practical exploitability. No active exploitation is confirmed (not in CISA KEV), and the authentication requirement (CVSS 4.0 PR:L) constrains the attacker pool to those already holding valid credentials on the target proxy.

LOW

2.1

0.2%

31

PoC No patch

CVE-2026-12772

Insufficient session expiration in LiteLLM's proxy authentication layer (versions 1.82.0 through 1.82.2) allows remote low-privileged users to reuse or manipulate session tokens generated by the PROXY_ADMIN API Key Generator beyond their intended validity window. The flaw resides in the `authenticate_user` function within `litellm/proxy/auth/login_utils.py`, where session/API key lifecycle management does not enforce expiration correctly per CWE-613. A public proof-of-concept exploit exists (GitHub gist), though no active exploitation has been confirmed via CISA KEV. The CVSS 4.0 score of 2.1 reflects a limited real-world blast radius despite the network-accessible attack vector.

LOW

2.1

0.2%

31

PoC No patch

CVE-2026-12774

Server-side request forgery in BerriAI LiteLLM versions up to 1.82.2 allows authenticated remote attackers to induce the proxy server to make arbitrary outbound HTTP requests by manipulating the MCP (Model Context Protocol) Server Connection Testing endpoint. The vulnerable function `_execute_with_mcp_client` in the experimental MCP server component fails to validate or restrict user-supplied connection targets, enabling internal network probing, potential access to cloud metadata services, and circumvention of network segmentation controls. A publicly available proof-of-concept exploit exists (GitHub gist by YLChen-007); no CISA KEV listing was present at time of analysis. The CVSS 4.0 reported score of 2.1 reflects threat-metric downgrade from E:P (proof-of-concept) and should not be taken as indicative of low inherent exploitability - the base network vector with low-privilege access represents a meaningful internal network exposure risk.

LOW

2.1

0.2%

31

PoC No patch

CVE-2026-12797

Incorrect authorization in BerriAI LiteLLM's enterprise banned keywords hook allows remote low-privileged authenticated users to bypass prompt content filtering by manipulating the `prompt` argument to the `async_pre_call_hook` function in `enterprise/enterprise_hooks/banned_keywords.py`. All versions in the 1.82.x series up to and including 1.82.5 are confirmed affected. A public proof-of-concept exploit is available via GitHub Gist, materially increasing the risk for enterprise deployments that rely on the banned keywords feature as a compliance or safety enforcement boundary; no confirmed CISA KEV listing exists at time of analysis.

LOW

2.1

0.2%

31

PoC No patch

CVE-2026-12798

Server-side request forgery in LiteLLM's experimental MCP OpenAPI Spec Loader allows authenticated remote attackers to coerce the server into issuing arbitrary HTTP requests by supplying a malicious `spec_path` value to the `load_openapi_spec_async` function. Affected versions are LiteLLM 1.82.0 through 1.82.2 as confirmed by EUVD. A public proof-of-concept exploit exists on GitHub, though the vulnerability is not in CISA KEV and the CVSS 4.0 score of 2.1 with E:P modifier reflects low-severity, authenticated exploitation with a known but apparently limited threat footprint.

LOW

2.1

0.2%

31

PoC No patch

CVE-2026-12771

Improper authorization in LiteLLM's M2M JWT Handler (litellm/proxy/auth/user_api_key_auth.py) enables remote attackers holding low-level credentials to bypass authorization controls in versions 1.82.0 through 1.82.2. The flaw resides in the machine-to-machine JWT authentication pathway of the LiteLLM proxy layer, where manipulated JWT inputs cause the handler to make incorrect authorization decisions, potentially granting unauthorized access to proxied LLM API resources. No active exploitation has been confirmed by CISA KEV, though publicly available exploit code exists (GitHub gist by YLChen-007), and the CVSS 4.0 vector carries an E:P temporal modifier reflecting this proof-of-concept availability; overall risk is tempered by high attack complexity.

LOW

1.3

0.2%

27

PoC No patch

CVE-2026-59821

Custom Code Guardrails in LiteLLM's AI Gateway proxy prior to 1.82.0-stable permitted privileged users with guardrail management rights to submit arbitrary Python code via the production create and update API paths, which executed unsandboxed within the proxy process. Unlike the test endpoint - which enforced sandbox controls - the production paths lacked equivalent validation, enabling the injected code to access and expose secrets, API keys, and environment variables available to the running process. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; risk is highest in multi-tenant or multi-operator LiteLLM deployments where guardrail management rights are distributed.

LOW

2.1

0.3%

11

CVE-2026-59819

Local filesystem read in LiteLLM's AI Gateway proxy prior to version 1.83.10-stable allows a proxy administrator to exfiltrate files from the server by supplying crafted oidc/file/ path references through the /health/test_connection endpoint. The vulnerability stems from unsanitized resolution of request-supplied environment and OIDC file references within litellm_params, giving a high-privileged caller a direct path to arbitrary file read. No public exploit code or active exploitation has been identified; the low CVSS 4.0 score of 2.1 reflects the high privilege bar and limited confidentiality impact.

LOW

2.1

0.3%

11

Severity Breakdown

Monthly CVE Trend

Affected Products (3)

Top Risky CVEs