These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-30623 is a critical remote code execution vulnerability in LiteLLM 1.18.10. The vulnerability allows users to execute arbitrary operating system commands via a JSON configuration specifying arbitrary command and args values. LiteLLM executes these values on the host without validation, enabling attackers to run arbitrary operating system commands. Successful exploitation may result in remote code [truncated]
CVE-2026-59822 is an authentication bypass vulnerability in LiteLLM's MCP Streamable HTTP endpoint. The issue allows an unauthenticated attacker to use a forged Authorization header to trigger an OAuth2 passthrough fallback path, potentially allowing unauthorized access to MCP tooling. This vulnerability affects LiteLLM versions prior to 1.84.0. Users should review their deployments and consider upgrading [truncated]
CVE-2026-59821 is a low-severity vulnerability in LiteLLM's Custom Code Guardrails. Prior to version 1.82.0-stable, the production create and update paths did not apply the same sandboxing and validation as the test endpoint. This allowed a privileged user to submit custom Python code that could execute in the LiteLLM proxy environment, potentially exposing secrets available to the process. The issue is f [truncated]
CVE-2026-59820 is a path traversal vulnerability in LiteLLM, a proxy server for LLM APIs. An authenticated user could upload a crafted skill archive to write to unintended directories. This issue allows attackers to potentially overwrite files outside the intended extraction or staging directory, posing a risk to the system's integrity. Users of LiteLLM, especially those with exposed LLM API routes, shoul [truncated]
CVE-2026-59819 is a low-severity vulnerability in LiteLLM's proxy server. Prior to version 1.83.10-stable, the /health/test_connection endpoint could be exploited by a proxy administrator or another privileged caller with permission to test model connections to read files from the local filesystem via an oidc/file/ reference. This issue is fixed in version 1.83.10-stable. The vulnerability class involves [truncated]
CVE-2026-49468 is a critical vulnerability in the LiteLLM proxy server, which acts as an AI Gateway to call LLM APIs in OpenAI or native format. The vulnerability has a CVSS score of 9.5 and was published on June 22, 2026. The issue is fixed in version 1.84.0 of LiteLLM. Users of affected versions should upgrade to 1.84.0 to mitigate the vulnerability. The CVE record and NVD detail provide further informa [truncated]
CVE-2026-12799 is a low-severity vulnerability in BerriAI's litellm, affecting versions up to 1.82.2. The issue lies in the ui_view_users function within litellm/proxy/management_endpoints/internal_user_endpoints.py, related to incomplete fix for CVE-2025-0628. This vulnerability allows for improper authorization and can be exploited remotely. The exploit has been publicly disclosed. Defenders should asse [truncated]
CVE-2026-12798 is a low-severity server-side request forgery vulnerability in BerriAI litellm up to 1.82.2. The issue affects the load_openapi_spec_async function in litellm/proxy/_experimental/mcp_server/openapi_to_mcp_generator.py. Attackers can initiate the attack remotely by manipulating the spec_path argument. The CVSS score is 2.1. The vendor was contacted early about this disclosure. Limited exploi [truncated]
CVE-2026-12797 is a low-severity security flaw in BerriAI litellm versions up to 1.82.5. The vulnerability affects the Completions Interface, specifically the async_pre_call_hook function in banned_keywords.py. This flaw allows for incorrect authorization, which can be exploited remotely. Although the exploit has been publicly released, the CVSS score is 2.1, indicating a low severity. Defenders should as [truncated]
CVE-2026-12795 is a vulnerability in BerriAI litellm versions up to 1.82.2. The issue affects the SSO Debug Flow, specifically the json.dumps function in litellm/proxy/management_endpoints/ui_sso.py, potentially leading to missing authentication. The vulnerability has a CVSS score of 5.5, indicating a medium severity level. The attack can be executed remotely, and the exploit has been publicly disclosed. [truncated]
CVE-2026-12774 is a server-side request forgery vulnerability detected in BerriAI litellm up to version 1.82.2. The vulnerability specifically affects the _execute_with_mcp_client function in the litellm/proxy/_experimental/mcp_server/rest_endpoints.py file within the MCP Server Connection Testing component. This vulnerability allows for remote exploitation, and its exploitation has been publicly disclose [truncated]
CVE-2026-12771 is a vulnerability in BerriAI litellm up to 1.82.2. The issue affects an unknown function in the litellm/proxy/auth/user_api_key_auth.py file within the M2M JWT Handler component, leading to improper authorization. The vulnerability can be exploited remotely with high complexity and difficult exploitability. The CVSS score is 1.3, indicating a LOW severity. Defenders should assess their exp [truncated]
CVE-2026-12770 is a low-severity vulnerability (CVSS Score: 2.1) affecting BerriAI litellm versions up to 1.63.1. The issue lies in the Admin Key Handler component, specifically in the file litellm/proxy/management_endpoints/key_management_endpoints.py, leading to improper authorization. The vulnerability can be exploited remotely, and a public exploit has been disclosed. Given the low severity and the ne [truncated]
A command injection vulnerability was discovered in BerriAI LiteLLM, a popular open-source library. This vulnerability, tracked as CVE-2026-42271, has a CVSS score of 8.7 and is classified as HIGH severity. The vulnerability was publicly disclosed on June 8, 2026, and added to the CISA Known Exploited Vulnerabilities (KEV) catalog on the same day, with a due date for mitigation set for June 22, 2026.
CVE-2026-47102 describes a broken access control issue in LiteLLM prior to 1.83.10. The /user/update endpoint restricts users to their own account, but it does not adequately restrict which fields can be modified, allowing a caller to change user_role to proxy_admin. That results in full administrative access to LiteLLM, including users, teams, keys, models, and prompt history. The issue is especially imp [truncated]
CVE-2026-47101 describes a privilege-escalation flaw in LiteLLM prior to 1.83.14. An authenticated internal_user could create an API key whose allowed_routes included routes outside their own permissions. Because those routes were stored without validating them against the creator’s authorization, the resulting key could be used to reach admin-only endpoints and bypass the RBAC checks that would normally [truncated]
A high-severity vulnerability, CVE-2026-42203, was found in LiteLLM Proxy Server versions 1.80.5 to before 1.83.7. The POST /prompts/test endpoint accepted user-supplied prompt templates without sandboxing, allowing crafted templates to run arbitrary code inside the LiteLLM Proxy process. This issue, patched in version 1.83.7, required only a valid proxy API key for exploitation, potentially exposing proc [truncated]
CVE-2026-42208 is a SQL injection vulnerability affecting BerriAI LiteLLM. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-05-08 and set a remediation due date of 2026-05-11. In practical terms, this means defenders should treat it as an actively exploited issue and move quickly on vendor guidance, compensating controls, or removal where mitigation is not available.
CVE-2026-40217 is a high-severity vulnerability in LiteLLM, allowing remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI. The vulnerability has a CVSS score of 8.8 and is classified as HIGH. It was published on April 10, 2026, and last modified on June 30, 2026. The vulnerability affects LiteLLM versions up to 2026-04-08. There is no evidence of ransom [truncated]
CVE-2026-35030 is a critical vulnerability in LiteLLM, a proxy server for LLM APIs, allowing unauthenticated attackers to bypass JWT authentication and inherit legitimate user identities and permissions. This issue arises from the use of token[:20] as the cache key for OIDC userinfo cache when JWT authentication is enabled. The vulnerability affects deployments with JWT/OIDC authentication enabled and is [truncated]
CVE-2026-35029 is a high-severity vulnerability in LiteLLM, a proxy server for LLM APIs. Prior to version 1.83.0, the /config/update endpoint lacks admin role authorization, allowing authenticated users to modify proxy configurations, environment variables, and register custom endpoint handlers pointing to attacker-controlled Python code. This could lead to remote code execution, reading arbitrary server [truncated]
