BerriAI LiteLLM

• CVE-2026-59822 High 8.8 Exploited LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback 0.8%
• CVE-2026-42208 Critical 9.8 Exploited LiteLLM: SQL injection in Proxy API key verification 89.4%
• CVE-2026-42271 High 8.8 Exploited LiteLLM: Authenticated command execution via MCP stdio test endpoints 91.4%
• CVE-2026-33634 Critical 9.4 Exploited Trivy ecosystem supply chain briefly compromised 59.7%
• CVE-2026-114612 Critical 9.9 LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key 0.3%
• CVE-2026-108575 Medium 6.3 BerriAI LiteLLM Secret Resolution main.py get_secret improper authorization 0.2%
• CVE-2026-108574 Medium 4.3 BerriAI LiteLLM Spend Tracking spend_management_endpoints.py ui_view_session_spend_logs authorization 0.2%
• CVE-2026-93355 High 8.1 LiteLLM Weak JWT Authentication via Email-Based User Lookup 0.3%
• CVE-2026-89032 High 7.7 BerriAI LiteLLM < 1.101.0-rc.1 Tenant Isolation Bypass via Semantic Cache Layer 0.3%
• CVE-2026-59823 Medium 5.3 LiteLLM: Server-side request forgery via the `user_config` request parameter in LiteLLM Proxy 0.4%
• CVE-2026-84377 Medium 6.5 LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters 0.5%
• CVE-2026-59819 Low 2.1 LiteLLM: Local file read via request-supplied OIDC file references 0.6%
• CVE-2026-59820 Medium 6.1 LiteLLM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 0.6%
• CVE-2026-59821 Low 2.1 LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks 0.9%
• CVE-2026-49468 High 8.1 LiteLLM: Authentication Bypass via Host Header Injection 3.0%
• CVE-2026-12799 Medium 4.3 BerriAI litellm Incomplete Fix CVE-2025-0628 internal_user_endpoints.py ui_view_users improper authorization 0.4%
• CVE-2026-12798 Medium 6.3 BerriAI litellm MCP OpenAPI Spec Loader openapi_to_mcp_generator.py load_openapi_spec_async server-side request forgery 0.4%
• CVE-2026-12797 Medium 6.3 BerriAI litellm Completions banned_keywords.py async_pre_call_hook authorization 0.4%
• CVE-2026-12796 Medium 6.3 BerriAI litellm SSO Authentication Flow ui_sso.py get_redirect_response_from_openid session expiration 0.6%
• CVE-2026-12795 High 7.3 BerriAI litellm SSO Debug Flow ui_sso.py json.dumps missing authentication 0.8%
• CVE-2026-12774 Medium 6.3 BerriAI litellm MCP Server Connection Testing rest_endpoints.py _execute_with_mcp_client server-side request forgery 0.4%
• CVE-2026-12773 High 7.3 BerriAI litellm MCP Proxy user_api_key_auth_mcp.py UserAPIKeyAuth improper authentication 1.0%
• CVE-2026-12772 Medium 6.3 BerriAI litellm PROXY_ADMIN database API Key Generator login_utils.py authenticate_user session expiration 0.4%
• CVE-2026-12771 Medium 5.0 BerriAI litellm M2M JWT user_api_key_auth.py improper authorization 0.4%
• CVE-2026-12770 Medium 5.4 BerriAI litellm Admin Key key_management_endpoints.py improper authorization 0.6%
• CVE-2026-47102 High 8.8 LiteLLM < 1.83.10 Privilege Escalation via User Update 0.7%
• CVE-2026-47101 High 8.8 LiteLLM < 1.83.14 Privilege Escalation via API Key Generation 1.2%
• CVE-2026-42203 High 8.8 LiteLLM: Server-Side Template Injection in /prompts/test endpoint 0.4%
• CVE-2026-40217 High 8.8 LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI. 17.0%
• CVE-2026-35030 Critical 9.1 LiteLLM has an authentication bypass via OIDC userinfo cache key collision 0.6%
• CVE-2026-35029 High 8.8 LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint 38.6%