litellm vulnerabilities

CVEs whose affected-version data names the litellm package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

47 CVEsRSS

CVE-2026-35030Critical· 9.1PoC

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, when JWT authentication is enabled (enable_jwt_auth: true), the OIDC userinfo cache uses token[:20] as the cache key. JWT headers prod…

▾ Abyssallitellm · litellmEPSS 0.63%via NVD

CVE-2026-35029HighPoC

LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint

LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint

▾ Midnightlitellm · litellmEPSS 39%via OSV

MAL-2026-2144Critical⚠ Exploited

Malicious code in litellm (PyPI)

Malicious code in litellm (PyPI)

▾ Abyssallitellm · litellmvia OSV

CVE-2024-10188High· 7.5

LiteLLM Vulnerable to Denial of Service (DoS)

LiteLLM Vulnerable to Denial of Service (DoS)

▾ Twilightlitellm · litellmEPSS 0.57%via OSV

CVE-2024-9606High· 7.5

LiteLLM Reveals Portion of API Key via a Logging File

LiteLLM Reveals Portion of API Key via a Logging File

▾ Twilightlitellm · litellmEPSS 0.77%via OSV

CVE-2025-0628High· 8.1

LiteLLM Has an Improper Authorization Vulnerability

LiteLLM Has an Improper Authorization Vulnerability

▾ Twilightlitellm · litellmEPSS 0.34%via OSV

CVE-2024-8984High· 7.5

LiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP Request

LiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP Request

▾ Twilightlitellm · litellmEPSS 0.86%via OSV

CVE-2025-0330High· 7.5

LiteLLM Has a Leakage of Langfuse API Keys

LiteLLM Has a Leakage of Langfuse API Keys

▾ Twilightlitellm · litellmEPSS 0.57%via OSV

CVE-2024-6825High· 8.8

LiteLLM Vulnerable to Remote Code Execution (RCE)

LiteLLM Vulnerable to Remote Code Execution (RCE)

▾ Twilightlitellm · litellmEPSS 1.7%via OSV

CVE-2024-6587High· 7.5PoC

LiteLLM Server-Side Request Forgery (SSRF) vulnerability

LiteLLM Server-Side Request Forgery (SSRF) vulnerability

▾ Midnightlitellm · litellmEPSS 34%via OSV

CVE-2024-5751Critical· 9.8PoC

BerriAI/litellm version v1.35.8 contains a vulnerability where an attacker can achieve remote code execution

BerriAI/litellm version v1.35.8 contains a vulnerability where an attacker can achieve remote code execution. The vulnerability exists in the `add_deployment` function, which decodes and decrypts environment variables from base64 and ass…

▾ Abyssallitellm · litellmEPSS 0.88%via NVD

CVE-2024-5710Medium· 5.3

litellm vulnerable to improper access control in team management

litellm vulnerable to improper access control in team management

▾ Sunlitlitellm · litellmEPSS 0.41%via OSV

CVE-2024-5225Medium· 6.4

SQL injection in litellm

SQL injection in litellm

▾ Sunlitlitellm · litellmEPSS 0.43%via OSV

CVE-2024-4890Medium· 4.9PoC

SQL injection in litellm

SQL injection in litellm

▾ Twilightlitellm · litellmEPSS 0.56%via OSV

CVE-2024-4888Medium· 6.5

Arbitrary file deletion in litellm

Arbitrary file deletion in litellm

▾ Sunlitlitellm · litellmEPSS 0.62%via OSV

CVE-2024-4264High· 7.2

litellm passes untrusted data to `eval` function without sanitization

litellm passes untrusted data to `eval` function without sanitization

▾ Twilightlitellm · litellmEPSS 0.88%via OSV

CVE-2024-2952Critical· 9.8

LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint

LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint

▾ Midnightlitellm · litellmEPSS 1.3%via OSV

litellm vulnerabilities (CVEs) — page 2 · VulnSea