MEDIUM6.5PyPI
GHSA-3cv6-jpf6-8222· CVE-2026-84377, PYSEC-2026-4066LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters
Modified: 10/1/2026
package
PyPI/litellm
pkg:pypi/litellm
MEDIUM6.5PyPI
GHSA-3xr8-qfvj-9p9j· CVE-2024-4888, PYSEC-2026-1540Arbitrary file deletion in litellm
Modified: 9/10/2026
CRITICAL9.8PyPI
GHSA-46cm-pfwv-cgf8· CVE-2024-2952, PYSEC-2026-387LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint
Modified: 9/10/2026
LOW2.1PyPI
GHSA-4g5m-c9r5-49xf· CVE-2026-59819, PYSEC-2026-3476LiteLLM: Local file read via request-supplied OIDC file references
Modified: 9/10/2026
HIGH7.3PyPI
GHSA-4jcj-7x88-m979· CVE-2026-12773, PYSEC-2026-4067LiteLLM: MCP Proxy Has Improper Authentication
Modified: 10/1/2026
CRITICAL9.8PyPI
GHSA-4xpc-pv4p-pm3w· CVE-2026-49468, PYSEC-2026-388LiteLLM: Authentication Bypass via Host Header Injection
Modified: 9/10/2026
HIGH8.8PyPI
GHSA-53gh-p8jc-7rg8· CVE-2024-6825, PYSEC-2026-1541LiteLLM Vulnerable to Remote Code Execution (RCE)
Modified: 9/10/2026
HIGH8.7PyPI
GHSA-53mr-6c8q-9789· CVE-2026-35029, PYSEC-2026-2597LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint
Modified: 9/10/2026
MEDIUM6.1PyPI
GHSA-5jmr-gcrj-2c9q· CVE-2026-59820, PYSEC-2026-3477LiteLLM: Arbitrary file write via path traversal in Skills archive extraction
Modified: 9/10/2026
CRITICALPyPI
GHSA-5mg7-485q-xm76Two LiteLLM versions published containing credential harvesting malware
Modified: 3/27/2026
HIGH8.6PyPI
GHSA-69x8-hrgq-fjj8LiteLLM: Password hash exposure and pass-the-hash authentication bypass
Modified: 9/10/2026
MEDIUM5.4PyPI
GHSA-6qr3-3g89-m4jj· CVE-2026-12770, PYSEC-2026-4068LiteLLM: Admin Key Handler Has Improper Authorization
Modified: 10/1/2026
CRITICAL9.8PyPI
GHSA-6wvf-77m9-58rm· CVE-2026-37004, PYSEC-2026-3861LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint
Modified: 9/10/2026
LOW2.1PyPI
GHSA-72m8-9m7m-h278· CVE-2026-59821, PYSEC-2026-3478LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
Modified: 9/10/2026
HIGH8.8PyPI
GHSA-7488-6r32-c95q· CVE-2026-59822, PYSEC-2026-3479LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
Modified: 9/10/2026
HIGH7.2PyPI
GHSA-7ggm-4rjg-594w· CVE-2024-4264, PYSEC-2026-1542litellm passes untrusted data to `eval` function without sanitization
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-879v-fggm-vxw2· CVE-2025-0330, PYSEC-2026-1543LiteLLM Has a Leakage of Langfuse API Keys
Modified: 9/10/2026
MEDIUM4.9PyPI
GHSA-8j42-pcfm-3467· CVE-2024-4890, PYSEC-2026-1544SQL injection in litellm
Modified: 9/10/2026
MEDIUM6.3PyPI
GHSA-c693-x898-5g4h· CVE-2026-12798, PYSEC-2026-4069BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader
Modified: 10/1/2026
HIGH7.5PyPI
GHSA-fh2c-86xm-pm2x· CVE-2024-8984, PYSEC-2026-1545LiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP Request
Modified: 9/10/2026
HIGH8.1PyPI
GHSA-fjcf-3j3r-78rp· CVE-2025-0628, PYSEC-2026-1546LiteLLM Has an Improper Authorization Vulnerability
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-g26j-5385-hhw3· CVE-2024-6587, PYSEC-2026-1547LiteLLM Server-Side Request Forgery (SSRF) vulnerability
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-g5pg-73fc-hjwq· CVE-2024-9606, PYSEC-2026-1548LiteLLM Reveals Portion of API Key via a Logging File
Modified: 9/10/2026
CRITICAL9.8PyPI
GHSA-gppg-gqw8-wh9g· CVE-2024-5751, PYSEC-2026-389litellm vulnerable to remote code execution based on using eval unsafely
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-gw2q-qw9j-rgv7· CVE-2024-10188, PYSEC-2026-1549LiteLLM Vulnerable to Denial of Service (DoS)
Modified: 9/10/2026
MEDIUM6.4PyPI
GHSA-h6m6-jj8v-94jj· CVE-2024-5225, PYSEC-2026-1550SQL injection in litellm
Modified: 9/10/2026
MEDIUM5.3PyPI
GHSA-hx8v-g79f-8w5f· CVE-2026-59823, PYSEC-2026-4070LiteLLM Proxy has server-side request forgery via the `user_config` request parameter
Modified: 10/1/2026
HIGH7.3PyPI
GHSA-j37q-q7p9-vpwm· CVE-2026-12795, PYSEC-2026-4071LiteLLM: SSO Debug Flow Has Improper Authentication
Modified: 10/1/2026
CRITICAL9.4PyPI
GHSA-jjhc-v7c2-5hh6· CVE-2026-35030, PYSEC-2026-390LiteLLM: Authentication bypass via OIDC userinfo cache key collision
Modified: 9/10/2026
MEDIUM4.3PyPI
GHSA-m2v5-74w2-qhcj· CVE-2026-12799, PYSEC-2026-4072BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure
Modified: 10/1/2026
MEDIUM6.3PyPI
GHSA-mf52-j94g-746m· CVE-2026-12772, PYSEC-2026-4073LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration
Modified: 10/1/2026
MEDIUM6.3PyPI
GHSA-p897-vf7j-f5h8· CVE-2026-12797, PYSEC-2026-4074BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints
Modified: 10/1/2026
MEDIUM5.0PyPI
GHSA-qmf3-4767-5fg3· CVE-2026-12771, PYSEC-2026-4075LiteLLM: M2M JWT Handler Has Improper Authorization
Modified: 10/1/2026
MEDIUM5.3PyPI
GHSA-qqcv-vg9f-5rr3· CVE-2024-5710, PYSEC-2026-1551litellm vulnerable to improper access control in team management
Modified: 9/10/2026
HIGH8.8PyPI
GHSA-qrc4-49gv-mv9m· CVE-2026-47101, PYSEC-2026-2598LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit
Modified: 9/10/2026
CRITICAL9.8PyPI
GHSA-r75f-5x8p-qvmc· CVE-2026-42208, PYSEC-2026-391LiteLLM has SQL Injection in Proxy API key verification
Modified: 10/5/2026
HIGH8.8PyPI
GHSA-v4p8-mg3p-g94g· CVE-2026-42271, PYSEC-2026-2599LiteLLM: Authenticated command execution via MCP stdio test endpoints
Modified: 9/10/2026
MEDIUM6.3PyPI
GHSA-w2mh-qq9q-453x· CVE-2026-12796, PYSEC-2026-4076BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens
Modified: 10/1/2026
HIGH8.8PyPI
GHSA-wpfp-gwwc-vwq6· CVE-2026-47102, PYSEC-2026-2600LiteLLM allows a user to modify their own user_role via the /user/update endpoint
Modified: 9/10/2026
HIGH8.8PyPI
GHSA-wxxx-gvqv-xp7p· CVE-2026-40217, PYSEC-2026-2601LiteLLM has a sandbox escape in custom-code guardrail
Modified: 9/10/2026
HIGH8.6PyPI
GHSA-xqmj-j6mv-4862· CVE-2026-42203, PYSEC-2026-2602LiteLLM: Server-Side Template Injection in /prompts/test endpoint
Modified: 9/10/2026
—PyPI
MAL-2026-2144· PYSEC-2026-2Malicious code in litellm (PyPI)
Modified: 10/21/2026
MEDIUM6.5PyPI
PYSEC-2026-1540· CVE-2024-4888, GHSA-3xr8-qfvj-9p9jArbitrary file deletion in litellm
Modified: 7/7/2026
HIGH8.8PyPI
PYSEC-2026-1541· CVE-2024-6825, GHSA-53gh-p8jc-7rg8LiteLLM Vulnerable to Remote Code Execution (RCE)
Modified: 7/7/2026
HIGH7.2PyPI
PYSEC-2026-1542· CVE-2024-4264, GHSA-7ggm-4rjg-594wlitellm passes untrusted data to `eval` function without sanitization
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-1543· CVE-2025-0330, GHSA-879v-fggm-vxw2LiteLLM Has a Leakage of Langfuse API Keys
Modified: 7/7/2026
MEDIUM4.9PyPI
PYSEC-2026-1544· CVE-2024-4890, GHSA-8j42-pcfm-3467SQL injection in litellm
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-1545· CVE-2024-8984, GHSA-fh2c-86xm-pm2xLiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP Request
Modified: 7/7/2026
HIGH8.1PyPI
PYSEC-2026-1546· CVE-2025-0628, GHSA-fjcf-3j3r-78rpLiteLLM Has an Improper Authorization Vulnerability
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-1547· CVE-2024-6587, GHSA-g26j-5385-hhw3LiteLLM Server-Side Request Forgery (SSRF) vulnerability
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-1548· CVE-2024-9606, GHSA-g5pg-73fc-hjwqLiteLLM Reveals Portion of API Key via a Logging File
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-1549· CVE-2024-10188, GHSA-gw2q-qw9j-rgv7LiteLLM Vulnerable to Denial of Service (DoS)
Modified: 7/7/2026
MEDIUM6.4PyPI
PYSEC-2026-1550· CVE-2024-5225, GHSA-h6m6-jj8v-94jjSQL injection in litellm
Modified: 7/7/2026
MEDIUM5.3PyPI
PYSEC-2026-1551· CVE-2024-5710, GHSA-qqcv-vg9f-5rr3litellm vulnerable to improper access control in team management
Modified: 7/7/2026
—PyPI
PYSEC-2026-2· MAL-2026-2144Two litellm versions published containing credential harvesting malware
Modified: 3/25/2026
HIGH8.7PyPI
PYSEC-2026-2597· CVE-2026-35029, GHSA-53mr-6c8q-9789LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint
Modified: 7/13/2026
HIGH8.8PyPI
PYSEC-2026-2598· CVE-2026-47101, GHSA-qrc4-49gv-mv9mLiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit
Modified: 7/13/2026
HIGH8.8PyPI
PYSEC-2026-2599· CVE-2026-42271, GHSA-v4p8-mg3p-g94gLiteLLM: Authenticated command execution via MCP stdio test endpoints
Modified: 7/13/2026
HIGH8.8PyPI
PYSEC-2026-2600· CVE-2026-47102, GHSA-wpfp-gwwc-vwq6LiteLLM allows a user to modify their own user_role via the /user/update endpoint
Modified: 7/13/2026
HIGH8.8PyPI
PYSEC-2026-2601· CVE-2026-40217, GHSA-wxxx-gvqv-xp7pLiteLLM has a sandbox escape in custom-code guardrail
Modified: 7/13/2026
HIGH8.6PyPI
PYSEC-2026-2602· CVE-2026-42203, GHSA-xqmj-j6mv-4862LiteLLM: Server-Side Template Injection in /prompts/test endpoint
Modified: 7/13/2026
LOW2.1PyPI
PYSEC-2026-3476· CVE-2026-59819, GHSA-4g5m-c9r5-49xfLiteLLM: Local file read via request-supplied OIDC file references
Modified: 7/23/2026
MEDIUM6.1PyPI
PYSEC-2026-3477· CVE-2026-59820, GHSA-5jmr-gcrj-2c9qLiteLLM: Arbitrary file write via path traversal in Skills archive extraction
Modified: 7/23/2026
LOW2.1PyPI
PYSEC-2026-3478· CVE-2026-59821, GHSA-72m8-9m7m-h278LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
Modified: 7/23/2026
HIGH8.8PyPI
PYSEC-2026-3479· CVE-2026-59822, GHSA-7488-6r32-c95qLiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
Modified: 7/23/2026
CRITICAL9.8PyPI
PYSEC-2026-3861· CVE-2026-37004, GHSA-6wvf-77m9-58rmLiteLLM vulnerable to server-side template injection in the /prompts/test endpoint
Modified: 9/10/2026
CRITICAL9.8PyPI
PYSEC-2026-387· CVE-2024-2952, GHSA-46cm-pfwv-cgf8LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint
Modified: 7/1/2026
CRITICAL9.5PyPI
PYSEC-2026-388· CVE-2026-49468, GHSA-4xpc-pv4p-pm3wLiteLLM: Authentication Bypass via Host Header Injection
Modified: 7/1/2026
CRITICAL9.8PyPI
PYSEC-2026-389· CVE-2024-5751, GHSA-gppg-gqw8-wh9glitellm vulnerable to remote code execution based on using eval unsafely
Modified: 7/1/2026
CRITICAL9.4PyPI
PYSEC-2026-390· CVE-2026-35030, GHSA-jjhc-v7c2-5hh6LiteLLM: Authentication bypass via OIDC userinfo cache key collision
Modified: 7/1/2026
CRITICAL9.8PyPI
PYSEC-2026-391· CVE-2026-42208, GHSA-r75f-5x8p-qvmcLiteLLM has SQL Injection in Proxy API key verification
Modified: 7/1/2026
MEDIUM6.5PyPI
PYSEC-2026-4066· CVE-2026-84377, GHSA-3cv6-jpf6-8222LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters
Modified: 10/1/2026
HIGH7.3PyPI
PYSEC-2026-4067· CVE-2026-12773, GHSA-4jcj-7x88-m979LiteLLM: MCP Proxy Has Improper Authentication
Modified: 10/1/2026
MEDIUM5.4PyPI
PYSEC-2026-4068· CVE-2026-12770, GHSA-6qr3-3g89-m4jjLiteLLM: Admin Key Handler Has Improper Authorization
Modified: 10/1/2026
MEDIUM6.3PyPI
PYSEC-2026-4069· CVE-2026-12798, GHSA-c693-x898-5g4hBerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader
Modified: 10/1/2026
MEDIUM5.3PyPI
PYSEC-2026-4070· CVE-2026-59823, GHSA-hx8v-g79f-8w5fLiteLLM Proxy has server-side request forgery via the `user_config` request parameter
Modified: 10/1/2026
HIGH7.3PyPI
PYSEC-2026-4071· CVE-2026-12795, GHSA-j37q-q7p9-vpwmLiteLLM: SSO Debug Flow Has Improper Authentication
Modified: 10/1/2026
MEDIUM4.3PyPI
PYSEC-2026-4072· CVE-2026-12799, GHSA-m2v5-74w2-qhcjBerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure
Modified: 10/1/2026
MEDIUM6.3PyPI
PYSEC-2026-4073· CVE-2026-12772, GHSA-mf52-j94g-746mLiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration
Modified: 10/1/2026
MEDIUM6.3PyPI
PYSEC-2026-4074· CVE-2026-12797, GHSA-p897-vf7j-f5h8BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints
Modified: 10/1/2026
MEDIUM5.0PyPI
PYSEC-2026-4075· CVE-2026-12771, GHSA-qmf3-4767-5fg3LiteLLM: M2M JWT Handler Has Improper Authorization
Modified: 10/1/2026
MEDIUM6.3PyPI
PYSEC-2026-4076· CVE-2026-12796, GHSA-w2mh-qq9q-453xBerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens
Modified: 10/1/2026