Full Report
A default low-privilege account on a LiteLLM proxy can climb to full admin and run code on the server by chaining three vulnerabilities, researchers at Obsidian Security disclosed LiteLLM is a widely deployed open-source AI gateway that brokers calls to more than 100 model providers behind one OpenAI-compatible interface. A server takeover exposes every provider key it holds, the secrets that
Analysis Summary
This report summarizes the critical vulnerability chain affecting LiteLLM, as disclosed by researchers from Obsidian Security.
# Vulnerability: LiteLLM Multi-Stage Privilege Escalation and RCE Chain
## CVE Details
* **CVE ID:** CVE-2026-47101 (Auth Bypass), CVE-2026-47102 (Privilege Escalation), CVE-2026-40217 (Remote Code Execution)
* **CVSS Score:** 9.9 (Critical) - Full Chain Score
* **CWE:**
* CWE-285: Improper Authorization
* CWE-269: Improper Privilege Management
* CWE-94: Improper Control of Generation of Code ('Code Injection')
## Affected Systems
* **Products:** LiteLLM (Open-source AI Gateway)
* **Versions:** Versions prior to v1.83.14-stable
* **Configurations:** Deployments where the LiteLLM proxy is used to broker calls to AI model providers and where the "Custom Code Guardrail" or "internal_user" features are active.
## Vulnerability Description
The vulnerability consists of an exploit chain involving three distinct flaws:
1. **CVE-2026-47101 (Authorization Bypass):** LiteLLM fails to validate the `allowed_routes` field when a low-privilege user generates a virtual API key. By providing a wildcard ("/*"), the user can bypass route restrictions, granting access to administrative endpoints.
2. **CVE-2026-47102 (Privilege Escalation):** The `/user/update` endpoint does not restrict which fields a user can modify. An attacker can update their own `user_role` to `proxy_admin`, gaining full administrative control over the gateway.
3. **CVE-2026-40217 (Remote Code Execution):** The "Custom Code Guardrail" feature uses the Python `exec()` function without sufficient sandboxing or input filtering. Administrative users (including escalated attackers) can execute arbitrary Python code, leading to a server-side reverse shell.
## Exploitation
* **Status:** PoC Available (Publicly demonstrated by Obsidian Security and X41 D-Sec)
* **Complexity:** Low
* **Attack Vector:** Network
## Impact
* **Confidentiality:** **Critical.** Attackers can access master keys, salt keys, provider API keys (OpenAI, Anthropic, etc.), and plaintext logs of all prompts and responses (PII, source code).
* **Integrity:** **Critical.** Attackers can use the callback mechanism to forge model responses and bypass safety checks, potentially manipulating AI agents or downstream applications.
* **Availability:** **High.** Full server takeover allows for the disruption of the gateway service.
## Remediation
### Patches
* **Upgrade to LiteLLM v1.83.14-stable or later.** This release includes the security fixes for all three CVEs.
### Workarounds
* Disable the "Custom Code Guardrail" feature if it is not strictly necessary.
* Restrict network access to the LiteLLM admin dashboard and API management routes to trusted IP ranges only.
* Monitor database logs for unauthorized changes to `user_role` fields.
## Detection
* **Indicators of Compromise:**
* Unusual virtual keys created with `allowed_routes` set to `["/*"]`.
* Logs showing non-admin users successfully reaching `/user/update` or `/guardrails/test_custom_code`.
* Unauthorized modifications to `user_role` in the LiteLLM database.
* Outbound network connections from the LiteLLM server to unexpected IP addresses (potential reverse shell).
* **Detection Methods:** Audit LiteLLM API logs for status code 200 on administrative endpoints originating from low-privilege internal user accounts.
## References
* [Obsidian Security Blog - LiteLLM Privilege Escalation and RCE] hxxps://www[.]obsidiansecurity[.]com/blog/litellm-privilege-escalation-rce
* [X41 D-Sec Advisory] hxxps://www[.]x41-dsec[.]de/lab/advisories/x41-2026-001-litellm/
* [NVD - CVE-2026-47101] hxxps://nvd[.]nist[.]gov/vuln/detail/CVE-2026-47101
* [LiteLLM GitHub Repository] hxxps://github[.]com/BerriAI/litellm