← Vulnerability feed

Vulnerability record · CVE-2026-47101 · published 21 May 2026

CVE-2026-47101: Litellm incorrect authorization vulnerability

Litellm · Litellm

LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit. When generating a key, the allowed_routes field is stored without verifying that the specified routes fall within the user's own permissions. A key created with access to admin-only routes can then be used to reach those routes successfully, bypassing the role-based access controls that would otherwise block the request, enabling full privilege escalation from internal_user to proxy_admin.

8.7 CVSS 4.0 High EPSS 1.3% · top 30.0% CWE-863 · Incorrect authorizationCWE-639 · Insecure direct object reference
8.7CVSS 4.0 base score
1.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
11References, 2 tagged exploit
23 Jul 2026Last modified by NVD

Description

LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit. When generating a key, the allowed_routes field is stored without verifying that the specified routes fall within the user's own permissions. A key created with access to admin-only routes can then be used to reach those routes successfully, bypassing the role-based access controls that would otherwise block the request, enabling full privilege escalation from internal_user to proxy_admin.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://gist.github.com/13ph03nix/9ec616e1fdc77b3673509c60206e827f ExploitMitigationThird Party Advisory
https://github.com/BerriAI/litellm/commit/2220f3076ac89bd2a2e3439acf57dcfbec2434c9 Patch
https://github.com/BerriAI/litellm/commit/5190bd07eb23a037745d86328096f54378f1614a Patch
https://github.com/BerriAI/litellm/commit/d910a95661fce3cdd36f3b06c03ecf9c46c6457c Patch
https://github.com/BerriAI/litellm/releases/tag/v1.83.14-stable Release Notes
https://huntr.com/bounties/8e75edfb-ff05-4e63-bfca-2d93d03fb3b9 ExploitThird Party Advisory
https://www.obsidiansecurity.com/blog/litellm-privilege-escalation-rce
https://www.vulncheck.com/advisories/litellm-privilege-escalation-via-api-key-generation Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-47101
https://bugzilla.redhat.com/show_bug.cgi?id=2480635
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47101.json

Track CVE-2026-47101 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.4CVE-2026-33634Trivy and trivy-action supply chain compromise via malicious release and tagsA threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in aquasecurity/trivy-acti…KEVEPSS 1.7%analysed9.3CVE-2026-42208LiteLLM proxy SQL injection in API key checkLiteLLM versions 1.81.16 to before 1.83.7 build a database query for proxy API key checks by concatenating the caller-supplied key into the query tex…KEVEPSS 5.8%analysed8.8CVE-2026-59822LiteLLM MCP endpoint auth bypass via OAuth2 passthrough fallbackLiteLLM's MCP Streamable HTTP endpoint, prior to 1.84.0, let an unauthenticated attacker send a fabricated Authorization header that triggered an OAu…KEVEPSS 0.84%analysed8.7CVE-2026-42271LiteLLM MCP test endpoints allow authenticated OS command injectionLiteLLM versions 1.74.2 through before 1.83.7 expose two MCP preview endpoints (POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list) th…KEVEPSS 13%analysed9.8CVE-2024-5751Litellm code injection vulnerabilityBerriAI/litellm version v1.35.8 contains a vulnerability where an attacker can achieve remote code execution. The vulnerability exists in the `add_de…EPSS 0.88%9.8CVE-2024-2952Litellm vulnerabilityBerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint. The vulnerability arises from the `hf_chat_te…EPSS 1.3%9.5CVE-2026-49468Litellm authentication bypass by spoofing vulnerabilityLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, a Host-header parsing flaw in the LiteLLM prox…EPSS 0.82%9.4CVE-2026-35030Litellm improper authentication vulnerabilityLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, when JWT authentication is enabled (enable_jwt…EPSS 0.88%

Source: NIST National Vulnerability Database (record CVE-2026-47101), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.