CVE-2026-108596 OpenLIT CVE debrief

Who should care

OpenLIT 2.1.0 users, particularly those with multiple projects configured, should assess exposure and verify patch availability. OpenLIT users should verify their version and configuration, restrict access to the trace read API, and monitor for suspicious activity.

Why it matters

CVE-2026-108596 is a medium-severity authorization bypass vulnerability in OpenLIT 2.1.0 that allows authenticated users to access other projects' telemetry. OpenLIT users should verify their version and configuration, restrict access to the trace read API, and monitor for suspicious activity. Patching or updating to a fixed version is recommended when available.

• Authenticated users may access unauthorized project telemetry
• Attackers may obtain sensitive information such as LLM prompts and completions
• Verification of OpenLIT version and configuration is necessary
• Patching or updating to a fixed version is required

Technical summary

The vulnerability allows authenticated users to read other projects' telemetry by supplying a forged x-openlit-project-id header. Attackers who know a victim project id and database config id can query the trace read API to obtain traces including LLM prompts and completions. This issue may impact users who have deployed OpenLIT 2.1.0 and have multiple projects configured. OpenLIT users should verify their version and configuration, restrict access to the trace read API, and monitor for suspicious activity. Patching or updating to a fixed version is recommended when available.

Defensive priority

Medium priority for OpenLIT 2.1.0 users to verify and patch

Recommended defensive actions

• Verify OpenLIT version and configuration
• Restrict access to the trace read API
• Monitor for suspicious activity
• Apply patches or updates when available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the authorization bypass vulnerability in OpenLIT 2.1.0. However, the corpus does not establish versions beyond 2.1.0, exploitation, impact, or remediation for other versions, which require verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.