CVE-2026-12797 Overview
CVE-2026-12797 is an improper authorization vulnerability [CWE-285] in BerriAI litellm through version 1.82.5. The flaw resides in the async_pre_call_hook function of enterprise/enterprise_hooks/banned_keywords.py within the Completions Interface component. An attacker can manipulate the prompt argument to bypass authorization controls enforced by the banned keywords hook. The attack is remotely exploitable and requires low privileges. The exploit code has been published, and the vendor was contacted prior to public disclosure.
Critical Impact
Remote attackers with low privileges can bypass banned keyword authorization controls in litellm's enterprise completions interface, weakening content moderation guardrails for LLM API traffic.
Affected Products
- BerriAI litellm versions up to and including 1.82.5
- The enterprise/enterprise_hooks/banned_keywords.py component
- Deployments using the Completions Interface with enterprise hook enforcement
Discovery Timeline
- 2026-06-21 - CVE-2026-12797 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-12797
Vulnerability Analysis
The vulnerability lives in the async_pre_call_hook function inside enterprise/enterprise_hooks/banned_keywords.py. This hook is intended to enforce authorization-like restrictions on prompt content before forwarding requests through litellm's Completions Interface. By manipulating the structure or content of the prompt argument, an attacker can cause the hook to fail open, allowing prompts that should be rejected to pass through to the downstream model.
The underlying weakness is classified as Improper Authorization [CWE-285]. The enforcement logic does not consistently validate every input variant the prompt argument can take, leading to inconsistent policy application. Authenticated users with low privileges can therefore trigger the bypass remotely over the network.
Root Cause
The root cause is incomplete input handling within the pre-call hook. The function evaluates the prompt against a banned keyword list but fails to normalize or fully traverse all supported prompt payload shapes. Attackers can craft prompts that evade keyword matching while still being processed normally by the model backend, breaking the intended authorization boundary.
Attack Vector
Exploitation occurs over the network through the litellm completions API. An attacker submits a crafted prompt payload that bypasses the banned keywords check in async_pre_call_hook. No user interaction is required, and only low-level privileges are needed to reach the affected endpoint. A proof-of-concept has been published in a public GitHub Gist linked from VulDB.
No verified code from the advisory is available. See the GitHub Gist PoC Repository and VulDB CVE-2026-12797 Reference for technical exploitation details.
Detection Methods for CVE-2026-12797
Indicators of Compromise
- Completions API requests containing prompt payloads with unusual nesting, encoding, or formatting variations that target the banned keyword filter.
- Successful completions from low-privileged API keys whose prompts contain content that should match the enterprise banned keyword policy.
- Increased volume of requests from a single API key shortly after a published PoC referenced in the VulDB Vulnerability #372559 entry.
Detection Strategies
- Log and review all requests handled by async_pre_call_hook in enterprise/enterprise_hooks/banned_keywords.py, including the raw prompt structure.
- Compare prompts that pass the hook against the configured banned keyword list using an independent post-hoc check to flag inconsistencies.
- Alert on prompts that include obfuscation patterns such as encoding tricks, nested message arrays, or non-standard role fields.
Monitoring Recommendations
- Enable verbose logging on the litellm enterprise hook pipeline and forward logs to a centralized analytics platform for correlation.
- Track per-key request patterns and policy decisions to baseline normal behavior and surface deviations.
- Monitor the litellm GitHub repository and VulDB references for updated patch information and exploit activity.
How to Mitigate CVE-2026-12797
Immediate Actions Required
- Inventory all litellm deployments and identify instances running version 1.82.5 or earlier with the enterprise banned keywords hook enabled.
- Restrict network access to the litellm completions endpoint so only trusted client identities can reach it.
- Rotate or scope down API keys assigned to low-privileged users until a fixed release is deployed.
Patch Information
No fixed version is listed in the available references at the time of writing. Operators should monitor the VulDB CVE-2026-12797 Reference and the BerriAI litellm repository for an official patched release that addresses the async_pre_call_hook authorization logic.
Workarounds
- Disable the enterprise banned keywords hook if you can enforce equivalent content controls at an upstream proxy or gateway.
- Implement a secondary content-moderation layer in front of litellm that normalizes prompt structures before policy evaluation.
- Apply strict allow-lists for prompt schemas and reject requests whose payload shape does not match expected formats.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
