LiteLLM Vulnerability Chain: What Security Teams Running AI Gateways Need to Do Now
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
A critical vulnerability chain in LiteLLM (CVSS 9.9) allows any low-privilege user to escalate to full admin and execute arbitrary code on the gateway host. The three-CVE chain (CVE-2026-47101, CVE-2026-47102, CVE-2026-40217) exploits a route bypass, an unrestricted user update endpoint, and an unsafe exec() in Custom Code Guardrails. A separate unauthenticated RCE (CVE-2026-42271) affecting versions 1.74.2–1.83.6 is already in CISA's Known Exploited Vulnerabilities catalog with a June 22 remediation deadline. A successful exploit exposes all provider API keys (OpenAI, Anthropic, Azure, AWS Bedrock), in-flight prompts, and MCP OAuth tokens. Immediate actions: upgrade to v1.83.14-stable, rotate all provider API keys, audit proxy_admin accounts, disable Custom Code Guardrails if unused, and block MCP REST test endpoints at the network perimeter.
