LiteLLM Vulnerability Chain Lets Low-Privilege Users Take Over AI Gateway Servers
18:39 · June 15, 2026 · Hacker News AI Section
A default low-privilege account on a LiteLLM proxy can climb to full admin and run code on the server by chaining three vulnerabilities, researchers at Obsidian Security disclosed LiteLLM is a widely deployed open-source AI gateway that brokers calls to more than 100 model providers behind one OpenAI-compatible interface. A server takeover exposes every provider key it holds, the secrets that
Summary
Researchers at Obsidian Security have identified a chain of three vulnerabilities in LiteLLM, an open-source proxy that provides a unified OpenAI-compatible interface to more than one hundred model providers. Rated CVSS 9.9, the chain lets an unauthenticated internal_user account obtain full proxy_admin rights and achieve arbitrary code execution on the host. BerriAI shipped the complete set of fixes in version 1.83.14-stable, released on 2 May.
The first flaw, CVE-2026-47101, is an authorization bypass. When an internal_user creates a virtual key, the proxy stores the caller-supplied allowed_routes value without verifying it against the user’s role. An attacker can therefore issue a key with allowed_routes set to ["/*"], granting access to every route, including those intended only for administrators. The same unchecked write affects additional key-management endpoints.
Once the route gate is passed, two further issues become reachable. CVE-2026-47102 permits privilege escalation because the /user/update handler accepts any field supplied by the caller; an internal_user can therefore set user_role to proxy_admin on their own record. CVE-2026-40217 is a sandbox escape in the Custom Code Guardrail feature. Production endpoints pass admin-supplied Python to exec() without restricting builtins, allowing an attacker to import os and spawn a reverse shell. A separate path through the /guardrails/test_custom_code playground, discovered by X41 D-Sec, defeats a regex deny-list via bytecode rewriting and reaches the same outcome.
A successful takeover exposes the master key, the salt used to decrypt stored credentials, every configured provider key, and all prompts and responses that transit the gateway. Because LiteLLM also sits between agents and models, an attacker can intercept and rewrite responses in flight by abusing the callback mechanism, which does not appear in the administrative interface. Organizations are advised to upgrade immediately, re-audit every proxy_admin account, review loaded callbacks in configuration files, and rotate any exposed credentials.
Why it matters
This article highlights a critical vulnerability in LiteLLM, a widely used AI infrastructure tool. It is highly relevant for Dutch security professionals as exploitation could lead to severe data breaches, exposing provider keys and violating strict EU data protection and AI security regulations.
