Unauthenticated File Read Leaks Master Key in LiteLLM Enterprise Proxy, CVSS 10.0
Do Son 
TL;DR
BerriAI has fixed a critical LiteLLM vulnerability that scores the maximum 10.0 on CVSS v3.1. Tracked as GHSA-w4c7-34wj-hqm8, the flaw lets an unauthenticated attacker steal the proxy’s master key. It affects LiteLLM proxies running with an Enterprise license.
One unauthenticated request can make the proxy read a local file and send it to an attacker. That file can expose the master key and provider API keys. Patched releases shipped on PyPI on October 27.
Why It Matters
LiteLLM acts as a gateway between apps and AI providers, so it holds many valuable API keys. According to the advisory, the leaked master key “gives the attacker full admin access to the proxy.” Worse, “in some configurations, this allows the attacker to then execute arbitrary python code as root.”
How the Attack Works
The attacker sends a request to any LLM route on the proxy. As the advisory explains, this “could make the proxy read a local file and send its contents to a URL chosen by the attacker.” Reading the process environment file exposes LITELLM_MASTER_KEY and stored provider keys.
Dylan Ong of Karmasec and Cyrill Bannwart of Compass Security reported this LiteLLM vulnerability. No CVE ID has been assigned yet, and no exploitation or public proof-of-concept has been confirmed.
Affected Versions
The LiteLLM vulnerability affects Enterprise deployments only. The advisory notes that “Open source deployments without a license are not affected.” Fixed versions are 1.103.10, 1.104.8, 1.105.6 and 1.106.5, one for each release line.
Patch and Mitigation
First, update to the fixed release for your branch. If you cannot update yet, block the callback-related JSON keys at your WAF or reverse proxy. Also, limit outbound traffic to known LLM provider endpoints, which stops the data theft step.
In addition, keep the proxy off the public internet. Rotate the master key and provider keys if your proxy was exposed.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
