LiteLLM's CVSS 10 bug is a reminder that your LLM gateway holds every key
LiteLLM published a critical advisory on Tuesday, GHSA-w4c7-34wj-hqm8, rated CVSS 10.0. In the project's words, an unauthenticated request to any LLM route on a proxy running with an Enterprise license "could make the proxy read a local file and send its contents to a URL chosen by the attacker." Reading the process environment exposes the master key and provider API keys, and in some configurations that leads to code execution as root.
Who is affected matters. Open source deployments without a license are not affected; this is an Enterprise-only code path. Patched releases are 1.103.10, 1.104.8, 1.105.6 and 1.106.5, which shipped about 35 minutes before the advisory went public. If you run a licensed proxy, upgrade first and read the advisory second. The advisory also lists request-body filters for a WAF if you cannot upgrade right away. The bug was reported by Dylan Ong of Karmasec and, independently, Cyrill Bannwart of Compass Security. No CVE ID has been assigned yet.
This is a separate bug from the 1.107.0 PyPI compromise we covered recently, and by the advisory's own history it is the third critical LiteLLM issue since May. The pattern is not really about LiteLLM. A gateway that fronts every model provider is, by design, the one box that holds every provider key, which makes it the highest-value target in an agent stack.
The most useful line in the advisory is the mitigation: the exploit needs the proxy to send the stolen file to an attacker's endpoint, so "with egress allowlisted, the exfiltration fails even if the vulnerable code is reached." Cohere gave the same advice on Monday for a completely different failure: deny agent egress by default. Two failure classes, one control. If your gateway or your agents can reach the whole internet, fix that this week.
Advisory: https://github.com/BerriAI/litellm/security/advisories/GHSA-w4c7-34wj-hqm8 Releases: https://github.com/BerriAI/litellm/releases
← Back to all articles
Who is affected matters. Open source deployments without a license are not affected; this is an Enterprise-only code path. Patched releases are 1.103.10, 1.104.8, 1.105.6 and 1.106.5, which shipped about 35 minutes before the advisory went public. If you run a licensed proxy, upgrade first and read the advisory second. The advisory also lists request-body filters for a WAF if you cannot upgrade right away. The bug was reported by Dylan Ong of Karmasec and, independently, Cyrill Bannwart of Compass Security. No CVE ID has been assigned yet.
This is a separate bug from the 1.107.0 PyPI compromise we covered recently, and by the advisory's own history it is the third critical LiteLLM issue since May. The pattern is not really about LiteLLM. A gateway that fronts every model provider is, by design, the one box that holds every provider key, which makes it the highest-value target in an agent stack.
The most useful line in the advisory is the mitigation: the exploit needs the proxy to send the stolen file to an attacker's endpoint, so "with egress allowlisted, the exfiltration fails even if the vulnerable code is reached." Cohere gave the same advice on Monday for a completely different failure: deny agent egress by default. Two failure classes, one control. If your gateway or your agents can reach the whole internet, fix that this week.
Advisory: https://github.com/BerriAI/litellm/security/advisories/GHSA-w4c7-34wj-hqm8 Releases: https://github.com/BerriAI/litellm/releases
Comments