LiteLLM Vulnerability Chain Lets Low-Privilege Users Take Over AI Gateway Servers
Summary: Obsidian Security disclosed a three-vulnerability chain in LiteLLM, an open-source AI gateway that brokers calls to more than 100 model providers, letting a default low-privilege account reach full admin and run code on the server; the chain is rated CVSS 9.9 and fixed in v1.83.14-stable, released May 2. The links are CVE-2026-47101, an authorization bypass where a caller-supplied allowed_routes field is stored unchecked and treated as a fallback grant, CVE-2026-47102, a privilege escalation through /user/update that accepts user_role: proxy_admin, and CVE-2026-40217, a sandbox escape in the Custom Code Guardrail where exec() without __builtins__ still exposes __import__, open, and eval.
What you should know: A compromised proxy holds the master key, the salt key that decrypts stored credentials, and every provider key for OpenAI, Anthropic, Gemini, Bedrock, and Azure, and it sits on the wire between agent and model, so an attacker can use LiteLLM's callback mechanism to swap a model response for a forged tool call - in Obsidian's demo against Claude Code, a developer typing hello got a reverse shell.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-40217CVE-2026-47101CVE-2026-47102
- Related
- ⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026