LiteLLM: LiteLLM allows an authenticated internal_user to create API keys with access to routes that…
LiteLLM
More for LiteLLM RSS feed for LiteLLM
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-47101
- Affects
- LiteLLM
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 21, 2026
- Source last modified
- October 8, 2026
Description
LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit. When generating a key, the allowed_routes field is stored without verifying that the specified routes fall within the user's own permissions. A key created with access to admin-only routes can then be used to reach those routes successfully, bypassing the role-based access controls that would otherwise block the request, enabling full privilege escalation from internal_user to proxy_admin.
Description quoted from the NVD record.
Who is affected
LiteLLM, made by BerriAI, is a tool that sits between your organization's apps and AI language model services and passes requests between them. This flaw affects versions before 1.83.14. Someone who already has a regular internal user account can create an access key and give it permission to reach parts of the product meant only for administrators, because those permissions are not checked against the user's own role. That key then works on the admin-only parts, so the user can gain full administrator control. This flaw is rated High.
What to do
- Find out who looks after LiteLLM for your organization: the person who installed it and runs it, or an IT provider or vendor who manages it for you.
- If someone in your organization runs it, ask them to check which version is installed and update it to version
1.83.14or later, which fixes this flaw. - If an IT provider or vendor runs it for you, send them this advisory and ask when the update will be done.
- For more detail on the fix, read the vendor advisory linked on this page.
Analysis written from the source record as of October 8, 2026 and reviewed before publishing.