litellm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-59821Lowlitellm: LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks CVE-2026-59822Highlitellm: LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback CVE-2026-59819Lowlitellm: LiteLLM: Local file read via request-supplied OIDC file references CVE-2026-59820Mediumlitellm: LiteLLM: Arbitrary file write via path traversal in Skills archive extraction CVE-2026-49468Criticallitellm: LiteLLM: Authentication Bypass via Host Header Injection CVE-2026-47102Highlitellm: LiteLLM allows a user to modify their own user_role via the /user/update endpoint CVE-2026-47101Highlitellm: LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit CVE-2026-40217Highlitellm: LiteLLM has a sandbox escape in custom-code guardrail CVE-2026-42271Highlitellm: LiteLLM: Authenticated command execution via MCP stdio test endpoints CVE-2026-42208Criticallitellm: LiteLLM has SQL Injection in Proxy API key verification CVE-2026-42203Highlitellm: LiteLLM: Server-Side Template Injection in /prompts/test endpoint GHSA-69X8-HRGQ-FJJ8Highlitellm: LiteLLM: Password hash exposure and pass-the-hash authentication bypass CVE-2026-35030Criticallitellm: LiteLLM: Authentication bypass via OIDC userinfo cache key collision CVE-2026-35029Highlitellm: LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint GHSA-5MG7-485Q-XM76Criticallitellm: Two LiteLLM versions published containing credential harvesting malware CVE-2025-0330Highlitellm: LiteLLM Has a Leakage of Langfuse API Keys CVE-2025-0628Highlitellm: LiteLLM Has an Improper Authorization Vulnerability CVE-2024-9606Highlitellm: LiteLLM Reveals Portion of API Key via a Logging File CVE-2024-8984Highlitellm: LiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP Request CVE-2024-6825Highlitellm: LiteLLM Vulnerable to Remote Code Execution (RCE)CVE-2024-10188Highlitellm: LiteLLM Vulnerable to Denial of Service (DoS)CVE-2024-6587Highlitellm: LiteLLM Server-Side Request Forgery (SSRF) vulnerability CVE-2024-5710Mediumlitellm: litellm vulnerable to improper access control in team management CVE-2024-5751Criticallitellm: litellm vulnerable to remote code execution based on using eval unsafely CVE-2024-5225Mediumlitellm: SQL injection in litellm

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo