CVE-2026-108596: OpenLIT Authorization Bypass Vulnerability

CVE-2026-108596 Overview

CVE-2026-108596 is an authorization bypass vulnerability in OpenLIT 2.1.0, an open-source observability platform for large language model (LLM) applications. Authenticated users can read telemetry belonging to other projects by supplying a forged x-openlit-project-id HTTP header. An attacker who knows a victim project identifier and the associated database configuration identifier can query the trace read API and retrieve traces, including recorded LLM prompts and completions. The weakness is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact

Authenticated attackers can exfiltrate cross-tenant LLM prompts, completions, and trace metadata from other OpenLIT projects by manipulating a single HTTP header.

Affected Products

• OpenLIT 2.1.0 (client component)
• Deployments exposing the trace read API to multi-tenant users
• Installations using the x-openlit-project-id header for project scoping

Discovery Timeline

• 2026-10-10 - CVE-2026-108596 published to the National Vulnerability Database (NVD)
• 2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-108596

Vulnerability Analysis

OpenLIT isolates telemetry per project using a project identifier that the client sends in the x-openlit-project-id header. The server trusts this header to scope database and trace queries. The authentication middleware verifies that the request carries a valid session but does not verify that the authenticated user is a member of the project named in the header. As a result, any logged-in account can swap in another tenant's project identifier and receive data back.

Because OpenLIT stores LLM traces, the leaked records include user prompts, model responses, token usage, and application context. These artifacts frequently contain source code, internal documents, customer data, and API keys that developers paste into LLM calls.

Root Cause

The root cause is missing object-level authorization in the trace read path. The middleware in src/client/src/middleware/check-auth.ts validates session state but omits a membership check between the authenticated user and the project referenced by the x-openlit-project-id header. The telemetry source resolver in src/client/src/lib/telemetry-source.ts then uses the attacker-supplied project identifier to look up the database configuration and execute queries, as noted in the VulnCheck advisory.

Attack Vector

Exploitation requires network access to the OpenLIT client application and any valid user account. The attacker enumerates or obtains a victim project identifier and the associated database configuration identifier, then issues a trace read request with those identifiers in the x-openlit-project-id header and body. The server returns traces owned by the victim project. No user interaction from the victim is required. Additional background is available in the HackMD technical write-up.

No verified proof-of-concept code is published. The vulnerability mechanism is described in prose; see the OpenLit telemetry source code and the auth check middleware for the affected code paths.

Detection Methods for CVE-2026-108596

Indicators of Compromise

• Requests to OpenLIT trace read endpoints containing an x-openlit-project-id header that does not match the project ownership of the authenticated session.
• Spikes in trace read volume from a single user account across multiple distinct project identifiers.
• Access to database configuration identifiers that are not registered to the requesting user's project membership.

Detection Strategies

• Enable application-level audit logging of every trace read request with the user ID, session project membership, and the x-openlit-project-id header value, then alert on mismatches.
• Correlate OpenLIT access logs with identity provider session data to flag horizontal access attempts across tenants.
• Baseline per-user project access patterns and alert on first-seen project identifiers in header traffic.

Monitoring Recommendations

• Forward OpenLIT reverse-proxy and application logs to a centralized logging platform and retain full request headers.
• Monitor for enumeration patterns against database configuration identifiers that precede trace read requests.
• Review LLM prompt and completion stores for unexpected read activity following disclosure of this issue.

How to Mitigate CVE-2026-108596

Immediate Actions Required

• Upgrade OpenLIT to a release later than 2.1.0 that enforces project membership on the trace read path once available from the OpenLIT GitHub repository.
• Restrict network access to the OpenLIT client to trusted operators until a fix is applied.
• Rotate any API keys, tokens, or secrets that may have been included in LLM prompts stored by affected projects.

Patch Information

At the time of NVD publication on 2026-10-10, the vendor advisory references in the VulnCheck advisory identify OpenLIT 2.1.0 as vulnerable. Monitor the OpenLIT GitHub repository for a fixed release and apply it as soon as it is available. The fix must add a server-side check that the authenticated user belongs to the project referenced by the x-openlit-project-id header.

Workarounds

• Place OpenLIT behind a reverse proxy that strips or validates the x-openlit-project-id header against the authenticated session's authorized project list.
• Segment OpenLIT deployments so each tenant runs an isolated instance with its own database, removing cross-tenant data from a single process.
• Limit user accounts to the minimum set of operators required until the authorization check is enforced in code.

# Example nginx header validation stub - reject requests whose
# x-openlit-project-id does not match an allowlist for the session.
map $http_x_openlit_project_id $project_allowed {
    default                 0;
    "project-tenant-a-uuid" 1;
    "project-tenant-b-uuid" 1;
}

server {
    location /api/trace {
        if ($project_allowed = 0) { return 403; }
        proxy_pass http://openlit_upstream;
    }
}