LiteLLM Vulnerability Chain Lets Low-Privilege Users Take Over AI Gateway Servers
Researchers at Obsidian Security revealed that a default low-privilege account on a LiteLLM proxy can link three vulnerabilities to become full admin and execute code on the server.
LiteLLM is a popular open-source AI gateway that uses a single OpenAI-compatible interface to broker calls to over 100 model providers.
When a server is taken over, all of its saved credentials, provider keys, and prompts and responses are revealed.
The entire chain is rated CVSS 9.9 by Obsidian, placing it in the critical range. The whole set of fixes was added by the maintainer BerriAI to LiteLLM v1.83.14-stable, which GitHub claims as being issued on May 2. Close the three-CVE chain by upgrading to that release or later.
CVE-2026-47101, a permission bypass, is the first link. LiteLLM saves the c...