PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-47101 BerriAI CVE debrief

CVE-2026-47101 describes a privilege-escalation flaw in LiteLLM prior to 1.83.14. An authenticated internal_user could create an API key whose allowed_routes included routes outside their own permissions. Because those routes were stored without validating them against the creator’s authorization, the resulting key could be used to reach admin-only endpoints and bypass the RBAC checks that would normally block the request. The end result is escalation from internal_user to proxy_admin.

Vendor
BerriAI
Product
litellm
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-21
Original CVE updated
2026-07-23
Advisory published
2026-05-21
Advisory updated
2026-07-23

Who should care

Administrators and security teams operating LiteLLM proxies, especially deployments that use internal_user accounts, route-scoped API keys, or RBAC to protect admin-only routes.

Technical summary

The issue is an authorization failure at API-key creation time. LiteLLM accepted an allowed_routes list for a newly generated key without checking whether the requested routes were actually permitted for the authenticated creator. That let a non-admin internal_user mint a key scoped to admin-only routes and then use that key to access those routes successfully. The weakness aligns with CWE-863 (incorrect authorization).

Defensive priority

High

Recommended defensive actions

  • Upgrade LiteLLM to 1.83.14-stable or later.
  • Revoke or rotate API keys created by internal_user accounts if their allowed_routes may have been overbroad.
  • Audit existing API keys for route scopes that include admin-only endpoints or otherwise exceed the creator’s permissions.
  • Review LiteLLM authorization logic around API-key generation to ensure route lists are validated against the caller’s privileges before storage.
  • Use the linked release and fix commits to confirm the deployed build includes the authorization patch.

Evidence notes

The supplied CVE description states that LiteLLM prior to 1.83.14 allowed an authenticated internal_user to create API keys with unauthorized routes, enabling escalation to proxy_admin. The NVD record is the source item and includes references to a GitHub gist disclosure, three LiteLLM commits, the v1.83.14-stable release, a Huntr bounty, and a VulnCheck advisory. The cited release tag supports 1.83.14 as the fixed version boundary.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-47101 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-47101

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-47101 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-47101

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.