LiteLLM: Authentication Bypass via Host Header Injection
LiteLLM
More for LiteLLM RSS feed for LiteLLM
- Severity
- Critical, CVSS 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-49468
- Affects
- LiteLLM
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 22, 2026
- Source last modified
- October 25, 2026
Description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, a Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes. The auth layer derived the effective route from request.url.path in litellm/proxy/auth/auth_utils.py::get_request_route(), which Starlette reconstructs from the Host header. A crafted Host could therefore make the auth gate evaluate a different route from the one FastAPI dispatched. This vulnerability is fixed in 1.84.0.
Description quoted from the NVD record.
Who is affected
Your organization is affected if it runs LiteLLM, made by BerriAI, a go-between service (often called an AI gateway) that lets your apps and staff reach AI language model services through one connection point. This flaw affects all versions before 1.84.0 of the LiteLLM proxy. Because of a mistake in how the proxy reads the address information in incoming web requests, a specially crafted request could, under specific conditions, let someone who has not logged in reach the protected management functions of the proxy. This flaw is rated Critical.
What to do
- Find out who runs LiteLLM for your organization: the person who installed it, or the IT provider or vendor who manages it for you.
- If your own staff or volunteer runs it, have them update LiteLLM to version
1.84.0or later, which fixes this flaw. - If an IT provider or vendor runs it for you, send them this advisory and ask when the update to
1.84.0will be done. - After the update, ask the person responsible to check that every copy of LiteLLM your organization uses now runs version
1.84.0or later.
Analysis written from the source record as of October 25, 2026 and reviewed before publishing.