LiteLLM: From version 1.80.5 to before version 1.83.7, the POST /prompts/test endpoint accepted…
LiteLLM
More for LiteLLM RSS feed for LiteLLM
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-42203
- Affects
- LiteLLM
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 8, 2026
- Source last modified
- October 26, 2026
Description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.80.5 to before version 1.83.7, the POST /prompts/test endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted template could run arbitrary code inside the LiteLLM Proxy process. The endpoint only checks that the caller presents a valid proxy API key, so any authenticated user could reach it. Depending on how the proxy is deployed, this could expose secrets in the process environment (such as provider API keys or database credentials) and allow commands to be run on the host. This issue has been patched in version 1.83.7.
Description quoted from the NVD record.
Who is affected
LiteLLM, made by BerriAI, is a go-between service that lets your organization's apps reach AI language models from different providers through one place. This flaw affects versions 1.80.5 up to, but not including, 1.83.7. A feature for testing prompt templates (reusable instructions sent to the AI) did not safely contain what users submitted. Anyone holding a valid LiteLLM access key could send a crafted template that runs their own code inside LiteLLM. Depending on the setup, this could expose secrets LiteLLM holds, such as AI provider keys or database passwords, and let commands run on the computer hosting LiteLLM. This flaw is rated High.
What to do
- Find out who runs LiteLLM for your organization: the person who installed it, or the IT provider or vendor who manages it.
- If you run it yourselves, check which version is installed. Versions 1.80.5 up to, but not including, 1.83.7 have this flaw.
- Update LiteLLM to version
1.83.7or later, which fixes this flaw. Do this soon, since any user with a valid access key could misuse it. - If an IT provider or vendor runs LiteLLM for you, send them this advisory and ask when the update will be done.
Analysis written from the source record as of October 26, 2026 and reviewed before publishing.