Vulnerability · Published Oct 29, 2025 · Assigned by zdi

CVE-2025-11203LiteLLM Information health API_KEY Information Disclosure Vulnerability

Low 3.5

In plain English

A low-severity information exposure in LiteLLM from LiteLLM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.0)3.5Low

Exploit odds (30 days)0.3%top 71.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

LiteLLM Information health API_KEY Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LiteLLM. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of the API_KEY parameter provided to the health endpoint. The issue results from exposing sensitive information to an unauthorized actor. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-26585.

Affected products (as reported)

Vendor	Product	Versions
LiteLLM	LiteLLM	10.2.2025

Weakness: CWE-200 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

References

ZDI-25-929 x_research-advisory
vendor-provided URL vendor-advisory