LiteLLM Vulnerability Chain Enables Full Server Takeover by Low-Privilege Users

A chain of three vulnerabilities in LiteLLM, a widely deployed open-source AI gateway, allows low-privilege users to escalate to full admin and execute arbitrary code on the server. Researchers at Obsidian Security disclosed the flaws, which carry a combined CVSS score of 9.9 (Critical).

The first bug, CVE-2026-47101, is an authorization bypass that lets internal users generate virtual API keys with wildcard routes, granting access to admin-only endpoints. The second, CVE-2026-47102, is a privilege escalation via the /user/update endpoint, allowing users to self-promote to proxy_admin. The third, CVE-2026-40217, is a sandbox escape in the Custom Code Guardrail, enabling remote code execution through Python’s exec() function.

Successful exploitation exposes the master key, salt key, database URL, and all configured provider keys (OpenAI, Anthropic, Gemini, etc.), as well as all prompts and responses passing through the gateway. Attackers can also use LiteLLM’s callback mechanism to forge model responses, leading to agent-side compromise. BerriAI has released fixes in LiteLLM v1.83.14-stable. Users are urged to upgrade immediately and audit accounts, guardrails, and callbacks.