CVE-2026-49468: Litellm Auth Bypass Vulnerability

CVE-2026-49468 Overview

CVE-2026-49468 is an authentication bypass vulnerability [CWE-290] affecting LiteLLM, an open-source proxy server that functions as an AI Gateway for calling large language model (LLM) APIs in OpenAI or native format. The flaw affects all LiteLLM versions prior to 1.84.0. An unauthenticated remote attacker can exploit the issue over the network without user interaction. Successful exploitation impacts the confidentiality, integrity, and availability of the proxy and downstream systems it brokers. The maintainers, BerriAI, addressed the issue in LiteLLM version 1.84.0.

Critical Impact
Unauthenticated network-based exploitation of an AI gateway proxy can expose API keys, model traffic, and downstream LLM provider accounts to attacker control.

Affected Products

LiteLLM versions prior to 1.84.0
BerriAI LiteLLM proxy server deployments
Self-hosted LiteLLM AI Gateway instances

Discovery Timeline

2026-06-22 - CVE-2026-49468 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-49468

Vulnerability Analysis

LiteLLM operates as an AI Gateway that proxies requests from client applications to a wide range of LLM providers using a unified OpenAI-compatible API. The advisory categorizes the flaw under [CWE-290], Authentication Bypass by Spoofing. An attacker can submit crafted requests that the proxy accepts as authenticated, gaining access to gateway functionality without presenting valid credentials.

Because the proxy brokers traffic to upstream model providers, an authentication bypass exposes any provider keys, virtual keys, team configurations, and request logs that the gateway manages. Attackers can issue model calls billed to the victim's provider accounts, retrieve cached prompts and responses, and pivot into administrative endpoints. The vendor advisory confirms the issue is fixed in 1.84.0 but does not disclose full exploitation details.

Root Cause

The root cause is a flaw in how LiteLLM validates the identity of incoming requests prior to version 1.84.0. Under [CWE-290], the authentication routine treats spoofed request attributes as proof of identity, allowing an actor to bypass the intended credential check. Refer to the GitHub Security Advisory GHSA-4xpc-pv4p-pm3w for technical specifics.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker who can reach the LiteLLM proxy endpoint, including internet-exposed deployments and internal services accessible after initial network access, can send crafted HTTP requests to bypass authentication. The vulnerability does not require local access, social engineering, or pre-existing credentials.

No public proof-of-concept exploit is referenced in the available CVE data, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-49468

Indicators of Compromise

Requests to LiteLLM API endpoints (for example /chat/completions, /v1/models, /key/generate) lacking expected Authorization headers or virtual keys yet receiving successful responses.
Unexpected creation, rotation, or listing of virtual keys through /key/* administrative endpoints.
Outbound LLM provider usage spikes or billing anomalies that do not correlate to known internal workloads.
Access to LiteLLM proxy from IP addresses outside the documented client allowlist.

Detection Strategies

Inventory LiteLLM deployments and inspect version metadata; treat any instance below 1.84.0 as vulnerable.
Review reverse-proxy and gateway logs for HTTP 200 responses to LiteLLM endpoints where authentication headers are missing or malformed.
Correlate LiteLLM access logs with upstream LLM provider audit logs to identify calls that bypassed the gateway's authenticated path.

Monitoring Recommendations

Alert on administrative endpoint access (/key/generate, /user/new, /team/new) from unexpected sources.
Monitor token consumption and request rate per API key for sudden deviations from baseline.
Forward LiteLLM container and application logs to a centralized analytics platform for retention and search.

How to Mitigate CVE-2026-49468

Immediate Actions Required

Upgrade LiteLLM to version 1.84.0 or later across all proxy instances.
Rotate every LLM provider API key, virtual key, and master key configured in the gateway after patching.
Restrict network exposure of the LiteLLM proxy to trusted client networks or place it behind an authenticating reverse proxy.
Audit recent request logs and provider billing for activity that may indicate prior exploitation.

Patch Information

BerriAI released the fix in LiteLLM 1.84.0. Release notes are available at GitHub Release v1.84.0, and the coordinated disclosure is published as GitHub Security Advisory GHSA-4xpc-pv4p-pm3w. Container image users should pull the updated tag and redeploy.

Workarounds

If immediate upgrade is not possible, block external access to the LiteLLM proxy at the network or ingress layer and limit traffic to known client IP ranges.
Enforce an additional authentication layer in front of LiteLLM, such as a reverse proxy that requires mutual TLS or a validated bearer token.
Disable or firewall administrative endpoints until the upgrade to 1.84.0 is completed.

bash

# Upgrade LiteLLM to the patched release
pip install --upgrade "litellm>=1.84.0"

# Or pull the patched container image
docker pull ghcr.io/berriai/litellm:v1.84.0