Vulnerability · Published Jun 22, 2026 · Assigned by GitHub_M

CVE-2026-49468LiteLLM: Authentication Bypass via Host Header Injection

High 8.1

In plain English

A high-severity authentication bypass by spoofing in litellm from BerriAI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.0% (higher than 88% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)3.0%top 12.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling2Nuclei, Public PoC

Official description

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, a Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes. The auth layer derived the effective route from request.url.path in litellm/proxy/auth/auth_utils.py::get_request_route(), which Starlette reconstructs from the Host header. A crafted Host could therefore make the auth gate evaluate a different route from the one FastAPI dispatched. This vulnerability is fixed in 1.84.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	litellm	1.84.0	GHSA-4xpc-pv4p-pm3w
PyPI	litellm	1.84.0	PYSEC-2026-388

Affected products (as reported)

Vendor	Product	Versions
BerriAI	litellm	< 1.84.0

Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/BerriAI/litellm/security/advisories/GHSA-4xpc-pv4p-pm3w x_refsource_CONFIRM
https://github.com/BerriAI/litellm/releases/tag/v1.84.0 x_refsource_MISC
https://access.redhat.com/security/cve/CVE-2026-49468 vdb-entry, x_refsource_REDHAT
RHBZ#2491520 issue-tracking, x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49468.json x_sadp-csaf-vex