In this article
If your team runs the LiteLLM proxy as an LLM gateway with an Enterprise license, update it now. BerriAI, LiteLLM’s maker, says an unauthenticated request could leak the proxy’s master key and the provider API keys it holds. The flaw has no CVE yet and isn’t in CISA’s Known Exploited Vulnerabilities catalog.
What happened
The flaw: According to BerriAI’s advisory GHSA-w4c7-34wj-hqm8, an unauthenticated request to any LLM route on a proxy with an Enterprise license “could” make it read a local file and send the contents to a URL the attacker chooses. Reading a file such as /proc/self/environ exposes LITELLM_MASTER_KEY and provider API keys, giving full admin access to the proxy. BerriAI says that “in some configurations” this lets an attacker run Python code as root. The advisory rates it 10.0 (critical).
Who is affected: Only proxies with an active Enterprise license. BerriAI says open-source deployments without a license aren’t affected.
The fix: BerriAI says the flaw is fixed in 1.103.10, 1.104.8, 1.105.6 and 1.106.5, all published Oct 28, 2026 (Manila time). The advisory lists the affected versions as “< 1.103.10”, “< 1.104.8”, “< 1.105.6” and “< 1.106.5”.
Exploitation: No source we checked reports attacks.
Related: A separate flaw, CVE-2026-114612 (GHSA-7hp6-4w63-5g45), lets an authenticated internal user escalate to proxy admin and run commands. GitHub’s advisory scores it 9.9 (CVSS 3.1) and 7.7 (CVSS 4.0); it has its own fixed versions, listed in that advisory.
Why it matters
A LiteLLM gateway usually holds the API keys for every model provider your team uses. If those keys leak, someone can run up your bills or read your traffic, and the master key hands over the proxy itself.
What to do
Our advice, based on BerriAI’s advisory:
- Upgrade to the fixed release for your line (1.103.10, 1.104.8, 1.105.6 or 1.106.5) or a later patch on that same line.
- Rotate the master key and every provider API key stored in the proxy, because a leak can’t be ruled out. Our LiteLLM 1.107.0 story lists what to rotate.
- Review proxy admin and audit logs, and provider usage and billing, for unexpected activity or spend.
- Keep the proxy off the public internet or behind authentication (VPN, mTLS, an authenticating ingress or an IP allowlist).
- As extra hardening, BerriAI recommends loading the master key from a secret manager instead of the process environment and setting a separate
LITELLM_SALT_KEY. - If you can’t update yet, BerriAI suggests blocking the trigger at a WAF or reverse proxy and limiting outbound traffic to your provider endpoints; the advisory lists the details.
Sources
| Source | What it confirms | Link |
|---|---|---|
| BerriAI advisory GHSA-w4c7-34wj-hqm8 (published Oct 28, 2026, Manila) | Flaw, Enterprise-only scope, CVSS 3.1 10.0, fixed versions, mitigations; no CVE | https://github.com/BerriAI/litellm/security/advisories/GHSA-w4c7-34wj-hqm8 |
| LiteLLM releases | 1.103.10, 1.104.8, 1.105.6, 1.106.5 published | https://github.com/BerriAI/litellm/releases |
| GitHub advisory GHSA-7hp6-4w63-5g45 | CVE-2026-114612 details and fixed versions | https://github.com/advisories/GHSA-7hp6-4w63-5g45 |
| NVD CVE-2026-114612 | Published; awaiting NVD analysis; CNA score 9.9 | https://nvd.nist.gov/vuln/detail/CVE-2026-114612 |
| CISA KEV catalog (version 2026.10.27) | Neither flaw listed | https://www.cisa.gov/known-exploited-vulnerabilities-catalog |
Last checked: Oct 28, 2026, 10:10 p.m. Manila (UTC+8). Method: We read BerriAI’s advisory, verified the fix against LiteLLM’s four release tags (the advisory links no fix commit), read the related GitHub advisory and NVD record, and checked CISA’s KEV catalog. How we work
Updates
- Oct 29, 2026, 8:05 a.m. Manila: First published.
Spotted an error? See our corrections policy and tell us.
