Vulnerability record · CVE-2026-12799 · published 21 June 2026

CVE-2026-12799: Litellm improper authorization vulnerability

Litellm · Litellm

A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this issue is the function ui_view_users of the file litellm/proxy/management_endpoints/internal_user_endpoints.py of the component Incomplete Fix CVE-2025-0628. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

2.1 CVSS 4.0 Low EPSS 0.43% · top 65.1% CWE-266 · CWE-266CWE-285 · Improper authorization

2.1CVSS 4.0 base score, v2 4.0

0.43%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References, 3 tagged exploit

24 Jun 2026Last modified by NVD

Description

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Litellm Litellm

References

Link	Tags
https://gist.github.com/YLChen-007/3ace22e33e468d0166fe609c9fdf4184	ExploitThird Party Advisory
https://vuldb.com/cve/CVE-2026-12799	Third Party AdvisoryVDB Entry
https://vuldb.com/submit/811291	Third Party AdvisoryExploitVDB Entry
https://vuldb.com/vuln/372561	Third Party AdvisoryVDB Entry
https://vuldb.com/vuln/372561/cti	Permissions RequiredVDB Entry
https://vuldb.com/submit/811291	Third Party AdvisoryExploitVDB Entry

Track CVE-2026-12799 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.4CVE-2026-33634Trivy and trivy-action supply chain compromise via malicious release and tagsA threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in aquasecurity/trivy-acti…KEVEPSS 1.7%analysed23 Mar 2026 9.3CVE-2026-42208LiteLLM proxy SQL injection in API key checkLiteLLM versions 1.81.16 to before 1.83.7 build a database query for proxy API key checks by concatenating the caller-supplied key into the query tex…KEVEPSS 5.8%analysed8 May 2026 8.8CVE-2026-59822LiteLLM MCP endpoint auth bypass via OAuth2 passthrough fallbackLiteLLM's MCP Streamable HTTP endpoint, prior to 1.84.0, let an unauthenticated attacker send a fabricated Authorization header that triggered an OAu…KEVEPSS 0.84%analysed8 Jul 2026 8.7CVE-2026-42271LiteLLM MCP test endpoints allow authenticated OS command injectionLiteLLM versions 1.74.2 through before 1.83.7 expose two MCP preview endpoints (POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list) th…KEVEPSS 93%analysed8 May 2026 9.8CVE-2024-5751Litellm code injection vulnerabilityBerriAI/litellm version v1.35.8 contains a vulnerability where an attacker can achieve remote code execution. The vulnerability exists in the `add_de…EPSS 0.88%27 Jun 2024 9.8CVE-2024-2952Litellm vulnerabilityBerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint. The vulnerability arises from the `hf_chat_te…EPSS 1.3%10 Apr 2024 9.5CVE-2026-49468Litellm authentication bypass by spoofing vulnerabilityLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, a Host-header parsing flaw in the LiteLLM prox…EPSS 3.0%22 Jun 2026 9.4CVE-2026-35030Litellm improper authentication vulnerabilityLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, when JWT authentication is enabled (enable_jwt…EPSS 0.88%6 Apr 2026

Source: NIST National Vulnerability Database (record CVE-2026-12799), CISA KEV, FIRST EPSS (scores of 2026-10-09). This page is refreshed as NVD updates the record.