Three LiteLLM Vulnerabilities Could Let Low-Privilege Users Take Over AI Gateways
Summary
Obsidian Security disclosed three LiteLLM flaws that can let a low-privilege user gain proxy-admin access and execute code, exposing secrets and enabling response tampering. BerriAI fixed the chain in v1.83.14-stable; the chain was not reported exploited in the wild.
Key points
- CVE-2026-47101 lets a low-privilege user bypass authorization by setting the allowed_routes field on a virtual API key.
- CVE-2026-47102 allows a user to change their own role to proxy_admin through the /user/update endpoint.
- CVE-2026-40217 enables code execution through the Custom Code Guardrail; researchers demonstrated a reverse shell.
- A successful chain could expose provider keys, stored credentials, prompts and responses, and could enable an attacker to alter model responses in transit.
- BerriAI fixed the three-flaw chain in LiteLLM v1.83.14-stable; administrators are advised to upgrade, review privileged accounts and callbacks, and rotate exposed secrets if exposure is suspected.
- Separately, CVE-2026-42271 in LiteLLM MCP preview endpoints was reported exploited in the wild and added to CISA's KEV catalog; it is distinct from this chain.
Article Details
- Vulnerability Types
- Authorization bypass
- Privilege escalation
- Sandbox escape leading to server-side code execution
- Severity
- CVSS 9.9 (Critical) for the full chain, as rated by Obsidian Security.
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1059.006 · PythonCVE-2026-40217 allows admin-supplied Python code to execute in the Custom Code Guardrail; the article describes a payload calling os.system.T1068 · Exploitation for Privilege EscalationCVE-2026-47102 lets a user promote their own account to proxy_admin by writing user_role through /user/update.T1565.002 · Transmitted Data ManipulationObsidian demonstrated that a compromised proxy could alter model responses in transit, including replacing a response with a forged tool call.