LI
Product
litellm
On CISA KEVExploited in the wild
39
CVEs
4
On KEV
9.8
Max CVSS
2
New 30D
Severity mix
Critical 6High 20Medium 13Low 0
Watch
Add litellm to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-42271 In wildKEV | 8.8 | May 8 | LiteLLM: Authenticated command execution via MCP stdio test endpoints Affected: 1.74.2 before 1.83.7 |
| CVE-2026-33634 In wildKEV | 8.8 | Mar 23 | Trivy ecosystem supply chain briefly compromised Affected: 1.82.7; 1.82.8 |
| CVE-2026-59822 In wildKEV | 8.2 | Jul 8 | LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback Affected: before 1.84.0 |
| CVE-2026-12770 | 8.8 | Jun 21 | BerriAI litellm Admin Key key_management_endpoints.py improper authorization Affected: 1.63.0; 1.63.1 |
| CVE-2026-47102 | 8.8 | May 21 | LiteLLM < 1.83.10 Privilege Escalation via User Update Affected: before 1.83.10 |
| CVE-2026-47101 | 8.8 | May 21 | LiteLLM < 1.83.14 Privilege Escalation via API Key Generation Affected: before 1.83.14 |
| CVE-2026-42203 | 8.8 | May 8 | LiteLLM: Server-Side Template Injection in /prompts/test endpoint Affected: 1.80.5 before 1.83.7 |
| CVE-2026-40217 | 8.8 | Apr 10 | LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI Affected: through 2026-04-08 |
| CVE-2026-35029 | 8.8 | Apr 6 | LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint Affected: before 1.83.0 |
| CVE-2024-6825 | 8.8 | Mar 20 | BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution Affected: before 1.65.4; 1.65.4 |
| CVE-2024-4888 | 8.1 | Jun 6 | BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on the `/audio/transcriptions` endpoint Affected: before 1.35.19 |
| CVE-2026-12771 | 7.5 | Jun 21 | BerriAI litellm M2M JWT user_api_key_auth.py improper authorization Affected: 1.82.0; 1.82.1; 1.82.2 |
| CVE-2025-0330 | 7.5 | Mar 20 | In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error occurs while parsing team settings Affected: 1.52.1 |
| CVE-2024-9606 | 7.5 | Mar 20 | In berriai/litellm before version 1.44.12, the `litellm/litellm_core_utils/litellm_logging.py` file contains a vulnerability where the API key masking code only masks the first 5… Affected: before 1.44.12 |
| CVE-2024-8984 | 7.5 | Mar 20 | A Denial of Service (DoS) vulnerability exists in berriai/litellm version v1.44.5 Affected: before 1.65.4; 1.65.4; 1.65.4; 1.65.4; 1.65.4 |
| CVE-2024-6587 | 7.5 | Sep 13 | A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10 Affected: 1.38.10 |
| CVE-2026-12795 | 7.3 | Jun 21 | BerriAI litellm SSO Debug Flow ui_sso.py json.dumps missing authentication Affected: 1.82.0; 1.82.1; 1.82.2 |
| CVE-2026-59821 | 7.2 | Jul 8 | LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks Affected: before 1.82.0; 1.82.0 |
| CVE-2024-5225 | 7.2 | Jun 6 | An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the `/global/spend/logs` endpoint Affected: through 1.40.2 |
| CVE-2024-4889 | 7.2 | Jun 6 | A code injection vulnerability exists in the berriai/litellm application, version 1.34.6, due to the use of unvalidated input in the eval function within the secret management… Affected: before 1.44.16 |
Showing 20