Leaked LiteLLM master key used to steal GitHub tokens and publish malicious 1.107.0
An unrevoked Agent Platform key from May let an attacker publish LiteLLM 1.107.0 to PyPI on October 21; PyPI later quarantined it.
78
Vendor
BerriAI
- Mentions · 7d0
- Mentions · 30d14
- All mentions15
- First seenSep 2, 2026
- Last mentioned8d ago
Timeline
15 articles · newest firstLiteLLM GitHub secrets taken 11 days before malicious package release
October 10 and 12 workflows posted CI secrets to webhook.site; a key committed May 27 was never revoked.
76
Compromised LiteLLM 1.107.0 steals credentials via Python startup
Starting Python with the package installed can run PRIVCOLLECT without importing LiteLLM; removing the package does not recover credentials.
88
Malicious LiteLLM 1.107.0 packages hit PyPI and Docker Hub
The poisoned build was online about three hours, downloaded over 49,000 times, and the latest clean release is 1.106.2.
78
LiteLLM release pipeline hacked to distribute info-stealer malware
Malicious LiteLLM 1.107.0 wheels and images were live for hours on October 21; roll back to 1.106.2 and rotate secrets.
78
Malicious LiteLLM v1.107.0 on PyPI and Docker stole credentials
The build stayed up for under two hours on PyPI; anyone who installed it is told to rotate credentials, not only upgrade.
82
Malicious LiteLLM 1.107.0 published after suspected token leak
Unpinned installs for a few hours on October 21 pulled a credential stealer and an hourly remote-code backdoor.
78
LiteLLM 1.107.0 release carried credential-stealing malware
Malicious Python startup hooks can collect cloud and AI credentials even when applications never import LiteLLM.
78
Malicious LiteLLM 1.107.0 steals credentials and installs a RAT
PyPI and Docker removed the trojanized release within hours; the latest safe version named is v1.106.2.
80
Malicious LiteLLM 1.107.0 on PyPI shipped an infostealer and RAT
All seven wheels and several Docker tags were tainted; PyPI removed the release, and Wiz calls 1.106.2 the latest safe build.
82
Compromised LiteLLM 1.107.0 on PyPI installs a stealer and backdoor
All seven wheels run the implants in every Python process; PyPI removed the release, and 1.106.2 plus two release candidates are clean.
78
Trojanized LiteLLM 1.107.0 on PyPI steals credentials
PyPI quarantined the upload within about two hours; matching Docker tags included latest, main-latest and main-stable.
82
Malicious LiteLLM 1.107.0 published with a credential stealer
PyPI and official Docker tags carried the release for about two hours; the RAT dead-drop never delivered a live second stage.
78
Metasploit Wrap Up: A Collection of What Can Only Be Called Eclectic Modules
Rapid7's Metasploit wrap-up adds 12 modules, including unauthenticated RCE for N-central, Langflow, LiteLLM, and dizqueTV.
52
CISA Adds Seven Known Exploited Vulnerabilities to Catalog
CISA added seven actively exploited vulnerabilities to its KEV catalog, including SonicWall SMA1000 SSRF and command injection flaws.
72
Related CVEs
by mentions- CVE-2026-8232914%9.8Improper Authentication in JFrog Artifactory Allows Unauthenticated Admin Access
- CVE-2026-077063%9.8Unauthenticated Remote Code Execution in Langflow validate Endpoint
- CVE-2026-958619%9.3Unauthenticated SQL Injection RCE in Sangoma Switchvox SMB Edition
- CVE-2026-4227191%8.7Command Injection in BerriAI LiteLLM AI Gateway Exploited in the Wild
- CVE-2026-8354910%7.8Authenticated OS Command Injection RCE in SonicWall SMA1000 Appliance Console
- CVE-2026-4871070%6.5HTTP Request Smuggling in Kludex Starlette (CVE-2026-48710)
- CVE-2024-58286<1%9.3dizqueTV 1.5.3 contains a remote code execution vulnerability that allows attackers to inject arbitrary commands through the FFMPEG Executable Path settings
- CVE-2026-43503<1%8.8Linux kernel: net: skbuff: propagate shared-frag marker through frag-transfer helpers Two frag-transfer helpers…
- CVE-2026-42249<1%7.7Ollama for Windows contains a Remote Code Execution vulnerability in its update mechanism due to improper handling of attacker‑controlled HTTP response headers
- File and Print Sharing service in Windows 95, Windows 98, and Windows Me does not properly check the password for a file share, which allows remote attackers…
Appears with
- litellmproduct · 15
- Socketorganization · 8
- Wizorganization · 6
- PyPIorganization · 5
- Aikidoorganization · 3
- GitHuborganization · 3
- privcollectmalware · 2
- GitLabproduct · 1
- JFrogorganization · 1
- Starletteproduct · 1
- JFrogvendor · 1
- SonicWall SMA1000product · 1
- SonicWallorganization · 1
- Sangoma Switchvoxproduct · 1
- Endor Labsorganization · 1
- N-ablevendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.