LiteLLM Vulnerability Chain Lets Low-Privilege Users Take Over AI Gateway Servers
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-40217 | LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI | 8.8 | 16% | PoC | |
| CVE-2026-42271 | Command Injection in BerriAI LiteLLM AI Gateway Exploited in the Wild | 8.7 | 91% | KEV | KEV |
CVE-2026-47101+1 related CVE | LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit | 8.7 | 1% | PoC ×2 |
From the original article
4 min read at thehackernews.com
A default low-privilege account on a LiteLLM proxy can climb to full admin and run code on the server by chaining three vulnerabilities, researchers at Obsidian Security disclosed LiteLLM is a widely deployed open-source AI gateway that brokers calls to more than 100 model providers behind one OpenAI-compatible interface.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.