{"kind": "product", "path": "vulns/pypi/litellm", "name": "litellm", "product": "litellm", "ecosystem": "PyPI", "items": [{"id": "GHSA-g5ff-637f-6q2m", "noindex": false, "published": "2026-10-27T15:32:36Z", "modified": "2026-10-27T15:47:24.299145356Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/ghsa-g5ff-637f-6q2m", "title": "LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`", "description": "## Summary\n\nAn authenticated LiteLLM proxy user could read arbitrary local files from the proxy runtime by sending a crafted `vertex_ai_credentials` value to `/utils/transform_request`. The request-body safety blocklist rejected `vertex_credentials` but missed its alias `vertex_ai_credentials`, which let the value reach the Vertex AI credential loader and trigger a file read that is sent to an attacker-controlled URL.\n\n## Impact\n\nA low-privilege authenticated user (only `internal_user_viewer`, obtainable through SSO login on many deployments) could read any file readable by the LiteLLM process. Reading files such as `/proc/self/environ` can d", "references": ["https://github.com/BerriAI/litellm/security/advisories/GHSA-g5ff-637f-6q2m", "https://github.com/BerriAI/litellm/pull/34189", "https://github.com/BerriAI/litellm/commit/065faf6e695be64a1a367601271839914e4a6621"], "fixes": ["1.95.0"], "products": [{"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}]}, {"id": "GHSA-hhww-mrg2-969h", "noindex": false, "published": "2026-10-27T15:31:56Z", "modified": "2026-10-27T15:47:24.395753522Z", "cvss": 6.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/ghsa-hhww-mrg2-969h", "title": "LiteLLM vulnerable to reflected XSS in /sso/debug/callback", "description": "### Summary\n\nThe `/sso/debug/callback` endpoint reflected identity-provider-controlled fields into an inline `<script>` block via `json.dumps`, which escapes JSON string syntax but not HTML context characters such as `</script>`. An IdP-returned string field containing `</script>` (for example a user-editable display name) closed the script block and executed attacker JavaScript in the proxy's origin.\n\n### Impact\n\nReflected XSS on the LiteLLM proxy origin. The route required no authentication, so an attacker with an account on the configured IdP whose claims pass such strings through verbatim could complete the SSO flow themselves and deliver", "references": ["https://github.com/BerriAI/litellm/security/advisories/GHSA-hhww-mrg2-969h", "https://github.com/BerriAI/litellm/pull/27498", "https://github.com/BerriAI/litellm/commit/13a193367f0ae2e7e8b29913e0d23a32d3bb0457"], "fixes": ["1.85.0"], "products": [{"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-114612", "noindex": false, "published": "2026-10-22T18:01:52.768Z", "modified": "2026-10-22T18:01:52.768Z", "cvss": 9.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.00319, "kev": false, "exploits": ["github-poc"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-114612", "title": "LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key", "description": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow. Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require EXPERIMENTAL_UI_L", "references": ["https://github.com/BerriAI/litellm/security/advisories/GHSA-7hp6-4w63-5g45", "https://github.com/BerriAI/litellm/commit/1d5fdc87fed66b49e1df8cf7d708ad93249eb7d0", "https://github.com/BerriAI/litellm/commit/9161d7f9d6073603ba61ee4aa5e2c0ef5b37a81b"], "fixes": ["1.100.4", "1.101.3", "1.102.2", "1.103.1", "1.104.0rc2"], "products": [{"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}, {"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}, {"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}, {"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}, {"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-59823", "noindex": false, "published": "2026-09-16T18:36:21.105Z", "modified": "2026-09-17T15:07:47.837Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "severity": "medium", "epss": 0.00439, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-59823", "title": "LiteLLM: Server-side request forgery via the `user_config` request parameter in LiteLLM Proxy", "description": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.9, an authenticated LiteLLM Proxy caller with a valid virtual key can place api_base inside the user_config request body to bypass is_request_body_safe, which blocks top-level api_base and base_url but previously did not inspect or reject user_config. Because user_config constructs the outbound router, the nested destination redirects a server-side request to an internal or external host selected by the caller and can expose endpoints the caller cannot otherwise access. This issue is fixed in version 1.83.9.", "references": ["https://github.com/BerriAI/litellm/security/advisories/GHSA-hx8v-g79f-8w5f", "https://github.com/BerriAI/litellm/pull/25827", "https://github.com/BerriAI/litellm/commit/47214be317f45a2d2ac08258362e0481411eb427"], "fixes": ["1.83.9"], "products": [{"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-84377", "noindex": false, "published": "2026-09-02T17:18:32.728Z", "modified": "2026-09-03T14:31:30.548Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.0054, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-84377", "title": "LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters", "description": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials to that destination. Request validation in litellm/proxy/auth/auth_utils.py, litellm/proxy/common_request_processing.py, litellm/proxy/health_endpoints/_health_endpoints.py, litellm/proxy/image_endpoints/endpoints.py, and litellm/proxy/litellm_pre_call_utils.py used incomplete checks that did not cover every sensitive parameter or inspect equivalen", "references": ["https://github.com/BerriAI/litellm/security/advisories/GHSA-3cv6-jpf6-8222", "https://github.com/BerriAI/litellm/pull/36011", "https://github.com/BerriAI/litellm/pull/36314"], "fixes": ["1.88.6", "1.89.7", "1.90.7", "1.91.5", "1.92.2", "1.93.2", "1.94.3", "1.95.1", "1.96.2"], "products": [{"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}, {"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}, {"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}, {"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}, {"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}, {"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}, {"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}, {"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}, {"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}, {"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-37004", "noindex": false, "published": "2026-08-27T00:00:00.000Z", "modified": "2026-09-01T03:56:26.290Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.00799, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-37004", "title": "CVE-2026-37004", "description": "BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.", "references": ["https://github.com/BerriAI/litellm/blob/244bdffd1bfe7bebdfdef516e1ebe426a898e2f0/litellm/proxy/prompts/prompt_endpoints.py#L1073", "https://yerangamage.com/cves/detail/?slug=litellm-ssti-rce", "https://nvd.nist.gov/vuln/detail/CVE-2026-37004"], "fixes": ["1.83.7"], "products": [{"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-59819", "noindex": false, "published": "2026-07-08T19:33:32.816Z", "modified": "2026-07-09T14:30:14.779Z", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00572, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-59819", "title": "LiteLLM: Local file read via request-supplied OIDC file references", "description": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.10-stable, LiteLLM's /health/test_connection endpoint resolved request-supplied environment and OIDC file references in litellm_params, allowing a proxy administrator or another privileged caller with permission to test model connections to read files from the local filesystem via an oidc/file/ reference. This issue is fixed in version 1.83.10-stable.", "references": ["https://github.com/BerriAI/litellm/security/advisories/GHSA-4g5m-c9r5-49xf", "https://github.com/BerriAI/litellm/pull/25592", "https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable"], "fixes": ["1.83.10"], "products": [{"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}, {"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-59822", "noindex": false, "published": "2026-07-08T19:32:18.611Z", "modified": "2026-09-03T03:56:05.174Z", "cvss": 8.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00836, "kev": true, "exploits": ["public-poc"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-59822", "title": "LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback", "description": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.", "references": ["https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q", "https://github.com/BerriAI/litellm/pull/26463", "https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c"], "fixes": ["1.84.0"], "products": [{"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}, {"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-59820", "noindex": false, "published": "2026-07-08T19:32:11.739Z", "modified": "2026-07-09T14:37:09.457Z", "cvss": 6.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00587, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-59820", "title": "LiteLLM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "description": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.7-stable, LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives, allowing an authenticated user with access to LiteLLM LLM API routes or a key whose allowed_routes includes /v1/skills, anthropic_routes, or llm_api_routes to upload a crafted skill archive containing path traversal entries that could be written outside the intended extraction or staging directory. This issue is fixed in version 1.83.7-stable.", "references": ["https://github.com/BerriAI/litellm/security/advisories/GHSA-5jmr-gcrj-2c9q", "https://github.com/BerriAI/litellm/pull/25475", "https://github.com/BerriAI/litellm/commit/6a15adcd64137d37f73dee76dfe7481f8c2d9196"], "fixes": ["1.83.7"], "products": [{"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}, {"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-59821", "noindex": false, "published": "2026-07-08T19:14:13.265Z", "modified": "2026-07-09T14:38:09.991Z", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00904, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-59821", "title": "LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks", "description": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to create or update guardrails to submit custom Python code that executed in the LiteLLM proxy environment and could expose secrets available to the process. This issue is fixed in version 1.82.0-stable.", "references": ["https://github.com/BerriAI/litellm/security/advisories/GHSA-72m8-9m7m-h278", "https://github.com/BerriAI/litellm/commit/e50b4486d0f7aa0497185a1ebcdd2c91f1769eba", "https://github.com/BerriAI/litellm/releases/tag/v1.82.0-stable"], "fixes": ["1.82.0"], "products": [{"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}, {"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-49468", "noindex": false, "published": "2026-06-22T20:37:14.494Z", "modified": "2026-07-15T00:47:34.603Z", "cvss": 9.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "critical", "epss": 0.03033, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-49468", "title": "LiteLLM: Authentication Bypass via Host Header Injection", "description": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, a Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes. The auth layer derived the effective route from request.url.path in litellm/proxy/auth/auth_utils.py::get_request_route(), which Starlette reconstructs from the Host header. A crafted Host could therefore make the auth gate evaluate a different route from the one FastAPI dispatched. This vulnerability is fixed in 1.84.0.", "references": ["https://github.com/BerriAI/litellm/security/advisories/GHSA-4xpc-pv4p-pm3w", "https://github.com/BerriAI/litellm/releases/tag/v1.84.0", "https://access.redhat.com/security/cve/CVE-2026-49468"], "fixes": ["1.84.0"], "products": [{"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}, {"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-12799", "noindex": false, "published": "2026-06-21T10:00:08.928Z", "modified": "2026-06-22T16:17:02.857Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.00426, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-12799", "title": "BerriAI litellm Incomplete Fix CVE-2025-0628 internal_user_endpoints.py ui_view_users improper authorization", "description": "A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this issue is the function ui_view_users of the file litellm/proxy/management_endpoints/internal_user_endpoints.py of the component Incomplete Fix CVE-2025-0628. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.", "references": ["https://vuldb.com/vuln/372561", "https://vuldb.com/vuln/372561/cti", "https://vuldb.com/cve/CVE-2026-12799"], "fixes": [], "products": [{"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-12798", "noindex": false, "published": "2026-06-21T09:30:08.242Z", "modified": "2026-06-22T17:14:45.929Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.004, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-12798", "title": "BerriAI litellm MCP OpenAPI Spec Loader openapi_to_mcp_generator.py load_openapi_spec_async server-side request forgery", "description": "A weakness has been identified in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function load_openapi_spec_async of the file litellm/proxy/_experimental/mcp_server/openapi_to_mcp_generator.py of the component MCP OpenAPI Spec Loader. This manipulation of the argument spec_path causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.", "references": ["https://vuldb.com/vuln/372560", "https://vuldb.com/vuln/372560/cti", "https://vuldb.com/cve/CVE-2026-12798"], "fixes": [], "products": [{"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-12797", "noindex": false, "published": "2026-06-21T09:15:08.592Z", "modified": "2026-06-22T13:35:44.784Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.004, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-12797", "title": "BerriAI litellm Completions banned_keywords.py async_pre_call_hook authorization", "description": "A security flaw has been discovered in BerriAI litellm up to 1.82.5. Affected is the function async_pre_call_hook of the file enterprise/enterprise_hooks/banned_keywords.py of the component Completions Interface. The manipulation of the argument prompt results in incorrect authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.", "references": ["https://vuldb.com/vuln/372559", "https://vuldb.com/vuln/372559/cti", "https://vuldb.com/cve/CVE-2026-12797"], "fixes": [], "products": [{"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-12796", "noindex": false, "published": "2026-06-21T09:00:09.028Z", "modified": "2026-06-22T18:12:18.953Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.0057, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-12796", "title": "BerriAI litellm SSO Authentication Flow ui_sso.py get_redirect_response_from_openid session expiration", "description": "A vulnerability was identified in BerriAI litellm up to 1.82.2. This impacts the function get_redirect_response_from_openid of the file litellm/proxy/management_endpoints/ui_sso.py of the component SSO Authentication Flow. The manipulation leads to session expiration. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.", "references": ["https://vuldb.com/vuln/372558", "https://vuldb.com/vuln/372558/cti", "https://vuldb.com/cve/CVE-2026-12796"], "fixes": [], "products": [{"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-12795", "noindex": false, "published": "2026-06-21T08:30:07.820Z", "modified": "2026-06-23T02:45:05.398Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.00795, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-12795", "title": "BerriAI litellm SSO Debug Flow ui_sso.py json.dumps missing authentication", "description": "A vulnerability was determined in BerriAI litellm up to 1.82.2. This affects the function json.dumps of the file litellm/proxy/management_endpoints/ui_sso.py of the component SSO Debug Flow. Executing a manipulation can lead to missing authentication. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.", "references": ["https://vuldb.com/vuln/372557", "https://vuldb.com/vuln/372557/cti", "https://vuldb.com/cve/CVE-2026-12795"], "fixes": [], "products": [{"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-12773", "noindex": false, "published": "2026-06-21T03:15:08.647Z", "modified": "2026-07-15T01:22:10.736Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.01017, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-12773", "title": "BerriAI litellm MCP Proxy user_api_key_auth_mcp.py UserAPIKeyAuth improper authentication", "description": "A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py of the component MCP Proxy. Executing a manipulation can lead to improper authentication. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.", "references": ["https://vuldb.com/vuln/372515", "https://vuldb.com/vuln/372515/cti", "https://vuldb.com/cve/CVE-2026-12773"], "fixes": ["1.84.0"], "products": [{"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-12772", "noindex": false, "published": "2026-06-21T02:00:08.882Z", "modified": "2026-06-22T17:20:24.396Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.004, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-12772", "title": "BerriAI litellm PROXY_ADMIN database API Key Generator login_utils.py authenticate_user session expiration", "description": "A security flaw has been discovered in BerriAI litellm up to 1.82.2. This impacts the function authenticate_user of the file litellm/proxy/auth/login_utils.py of the component PROXY_ADMIN database API Key Generator. Performing a manipulation results in session expiration. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.", "references": ["https://vuldb.com/vuln/372514", "https://vuldb.com/vuln/372514/cti", "https://vuldb.com/cve/CVE-2026-12772"], "fixes": [], "products": [{"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-12771", "noindex": false, "published": "2026-06-21T01:00:12.198Z", "modified": "2026-06-22T13:33:10.626Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "severity": "low", "epss": 0.00431, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-12771", "title": "BerriAI litellm M2M JWT user_api_key_auth.py improper authorization", "description": "A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/user_api_key_auth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.", "references": ["https://vuldb.com/vuln/372513", "https://vuldb.com/vuln/372513/cti", "https://vuldb.com/cve/CVE-2026-12771"], "fixes": [], "products": [{"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-12770", "noindex": false, "published": "2026-06-21T00:15:08.657Z", "modified": "2026-06-22T18:12:38.503Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.00569, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-12770", "title": "BerriAI litellm Admin Key key_management_endpoints.py improper authorization", "description": "A vulnerability was determined in BerriAI litellm up to 1.63.1. The impacted element is an unknown function of the file litellm/proxy/management_endpoints/key_management_endpoints.py of the component Admin Key Handler. This manipulation causes improper authorization. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 23781. It is recommended to apply a patch to fix this issue. The vendor was contacted early about this disclosure.", "references": ["https://vuldb.com/vuln/372512", "https://vuldb.com/vuln/372512/cti", "https://vuldb.com/cve/CVE-2026-12770"], "fixes": [], "products": [{"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}]}], "total": 45, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 3, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "litellm", "path": "vulns/pypi/litellm", "ecosystem": "PyPI"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": ["1.104.0rc1", "1.103.0", "1.102.1", "1.102.0", "1.101.2", "1.101.1", "1.101.0", "1.100.3", "1.100.2", "1.100.1", "1.100.0rc1", "1.100.0.dev2"], "stats": {"recent": 3, "kev": 0}, "lastmod": "2026-10-27T15:47:24.395753522Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}