PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-12797 BerriAI CVE debrief

CVE-2026-12797 is a low-severity security flaw in BerriAI litellm versions up to 1.82.5. The vulnerability affects the Completions Interface, specifically the async_pre_call_hook function in banned_keywords.py. This flaw allows for incorrect authorization, which can be exploited remotely. Although the exploit has been publicly released, the CVSS score is 2.1, indicating a low severity. Defenders should assess their exposure and prioritize patching based on their specific use cases.

Vendor
BerriAI
Product
litellm
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-21
Original CVE updated
2026-06-24
Advisory published
2026-06-21
Advisory updated
2026-06-24

Who should care

Organizations using BerriAI litellm versions up to 1.82.5 should be aware of this vulnerability. Specifically, those who utilize the Completions Interface and have not updated to a patched version may be exposed to incorrect authorization issues. Given the low severity and remote exploitability, defenders should evaluate their risk and apply patches or mitigations as necessary.

Technical summary

The CVE-2026-12797 vulnerability is caused by a flaw in the async_pre_call_hook function of the banned_keywords.py file in the enterprise/enterprise_hooks directory of BerriAI litellm up to 1.82.5. This function is part of the Completions Interface. The vulnerability leads to incorrect authorization when the prompt argument is manipulated. The Common Vulnerabilities and Exposures (CVE) score is 2.1, classified as low severity. The CVSS vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

Low severity, but prioritize patching due to remote exploitability and public exploit availability.

Recommended defensive actions

  • Inventory and review current BerriAI litellm versions to identify instances up to 1.82.5.
  • Apply patches or updates to BerriAI litellm to a version beyond 1.82.5.
  • Review and restrict access to the Completions Interface, especially in enterprise environments.
  • Monitor for suspicious activity related to the async_pre_call_hook function and banned_keywords.py.
  • Consider compensating controls, such as additional authentication or input validation, if patching is not immediately feasible.

Evidence notes

The primary evidence for CVE-2026-12797 comes from the NVD and Vuldb sources. The vulnerability affects BerriAI litellm up to version 1.82.5, specifically in the Completions Interface's async_pre_call_hook function. Evidence limits suggest that while the exploit has been released publicly, details on widespread exploitation are not provided. Defenders should verify their current litellm version and review the official CVE and NVD records for further details.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-12797 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-12797

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-12797 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-12797

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.