LI
Product
litellm
On CISA KEVExploited in the wild
39
CVEs
4
On KEV
9.8
Max CVSS
2
New 30D
Severity mix
Critical 6High 20Medium 13Low 0
Watch
Add litellm to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-42208 In wildKEV | 9.8 | May 8 | LiteLLM: SQL injection in Proxy API key verification Affected: 1.81.16 before 1.83.7 |
| CVE-2026-42271 In wildKEV | 8.8 | May 8 | LiteLLM: Authenticated command execution via MCP stdio test endpoints Affected: 1.74.2 before 1.83.7 |
| CVE-2026-33634 In wildKEV | 8.8 | Mar 23 | Trivy ecosystem supply chain briefly compromised Affected: 1.82.7; 1.82.8 |
| CVE-2026-59822 In wildKEV | 8.2 | Jul 8 | LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback Affected: before 1.84.0 |
| CVE-2026-49468 | 9.8 | Jun 22 | LiteLLM: Authentication Bypass via Host Header Injection Affected: before 1.84.0 |
| CVE-2026-12773 | 9.8 | Jun 21 | BerriAI litellm MCP Proxy user_api_key_auth_mcp.py UserAPIKeyAuth improper authentication Affected: 1.59.0; 1.59.1; 1.59.2; 1.59.3; 1.59.4; 1.59.5; +3 more |
| CVE-2024-5751 | 9.8 | Jun 27 | BerriAI/litellm version v1.35.8 contains a vulnerability where an attacker can achieve remote code execution Affected: 1.35.8 |
| CVE-2024-2952 | 9.8 | Apr 10 | BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint Affected: before 1.34.42 |
| CVE-2026-35030 | 9.1 | Apr 6 | LiteLLM has an authentication bypass via OIDC userinfo cache key collision Affected: before 1.83.0 |
| CVE-2026-12770 | 8.8 | Jun 21 | BerriAI litellm Admin Key key_management_endpoints.py improper authorization Affected: 1.63.0; 1.63.1 |
| CVE-2026-47102 | 8.8 | May 21 | LiteLLM < 1.83.10 Privilege Escalation via User Update Affected: before 1.83.10 |
| CVE-2026-47101 | 8.8 | May 21 | LiteLLM < 1.83.14 Privilege Escalation via API Key Generation Affected: before 1.83.14 |
| CVE-2026-42203 | 8.8 | May 8 | LiteLLM: Server-Side Template Injection in /prompts/test endpoint Affected: 1.80.5 before 1.83.7 |
| CVE-2026-40217 | 8.8 | Apr 10 | LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI Affected: through 2026-04-08 |
| CVE-2026-35029 | 8.8 | Apr 6 | LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint Affected: before 1.83.0 |
| CVE-2024-6825 | 8.8 | Mar 20 | BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution Affected: before 1.65.4; 1.65.4 |
| CVE-2024-4888 | 8.1 | Jun 6 | BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on the `/audio/transcriptions` endpoint Affected: before 1.35.19 |
| CVE-2026-12771 | 7.5 | Jun 21 | BerriAI litellm M2M JWT user_api_key_auth.py improper authorization Affected: 1.82.0; 1.82.1; 1.82.2 |
| CVE-2025-0330 | 7.5 | Mar 20 | In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error occurs while parsing team settings Affected: 1.52.1 |
| CVE-2024-9606 | 7.5 | Mar 20 | In berriai/litellm before version 1.44.12, the `litellm/litellm_core_utils/litellm_logging.py` file contains a vulnerability where the API key masking code only masks the first 5… Affected: before 1.44.12 |
| CVE-2024-8984 | 7.5 | Mar 20 | A Denial of Service (DoS) vulnerability exists in berriai/litellm version v1.44.5 Affected: before 1.65.4; 1.65.4; 1.65.4; 1.65.4; 1.65.4 |
| CVE-2024-6587 | 7.5 | Sep 13 | A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10 Affected: 1.38.10 |
| CVE-2026-12795 | 7.3 | Jun 21 | BerriAI litellm SSO Debug Flow ui_sso.py json.dumps missing authentication Affected: 1.82.0; 1.82.1; 1.82.2 |
| CVE-2026-59821 | 7.2 | Jul 8 | LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks Affected: before 1.82.0; 1.82.0 |
| CVE-2024-5225 | 7.2 | Jun 6 | An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the `/global/spend/logs` endpoint Affected: through 1.40.2 |
| CVE-2024-4889 | 7.2 | Jun 6 | A code injection vulnerability exists in the berriai/litellm application, version 1.34.6, due to the use of unvalidated input in the eval function within the secret management… Affected: before 1.44.16 |
| CVE-2026-59820 | 6.5 | Jul 8 | LiteLLM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affected: before 1.83.7; 1.83.7 |
| CVE-2024-5710 | 6.5 | Jun 27 | berriai/litellm version 1.34.34 is vulnerable to improper access control in its team management functionality Affected: 1.34.34 |
| CVE-2026-108575 | 6.3 | Oct 11 | BerriAI LiteLLM Secret Resolution main.py get_secret improper authorization Affected: 1.0; 1.1; 1.2; 1.3; 1.4; 1.5; +34 more |
| CVE-2026-12798 | 6.3 | Jun 21 | BerriAI litellm MCP OpenAPI Spec Loader openapi_to_mcp_generator.py load_openapi_spec_async server-side request forgery Affected: 1.82.0; 1.82.1; 1.82.2 |
| CVE-2026-12797 | 6.3 | Jun 21 | BerriAI litellm Completions banned_keywords.py async_pre_call_hook authorization Affected: 1.82.0; 1.82.1; 1.82.2; 1.82.3; 1.82.4; 1.82.5 |
| CVE-2026-12796 | 6.3 | Jun 21 | BerriAI litellm SSO Authentication Flow ui_sso.py get_redirect_response_from_openid session expiration Affected: 1.82.0; 1.82.1; 1.82.2 |
| CVE-2026-12774 | 6.3 | Jun 21 | BerriAI litellm MCP Server Connection Testing rest_endpoints.py _execute_with_mcp_client server-side request forgery Affected: 1.82.0; 1.82.1; 1.82.2 |
| CVE-2026-12772 | 6.3 | Jun 21 | BerriAI litellm PROXY_ADMIN database API Key Generator login_utils.py authenticate_user session expiration Affected: 1.82.0; 1.82.1; 1.82.2 |
| CVE-2025-45809 | 5.4 | Jul 3 | SQL Injection vulnerability in BerriAI LiteLLM before 1.81.0 allows attackers to execute arbitrary commands via the key parameter to the "/key/block" and "/key/unblock" API… Affected: 1.65.4 |
| CVE-2026-59819 | 4.9 | Jul 8 | LiteLLM: Local file read via request-supplied OIDC file references Affected: before 1.83.10; 1.83.10 |
| CVE-2024-4890 | 4.9 | Jun 6 | A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process Affected: 1.27.14 |
| CVE-2026-108574 | 4.3 | Oct 11 | BerriAI LiteLLM Spend Tracking spend_management_endpoints.py ui_view_session_spend_logs authorization Affected: 1.0; 1.1; 1.2; 1.3; 1.4; 1.5; +34 more |
| CVE-2026-12799 | 4.3 | Jun 21 | BerriAI litellm Incomplete Fix CVE-2025-0628 internal_user_endpoints.py ui_view_users improper authorization Affected: 1.82.0; 1.82.1; 1.82.2 |
Showing 39