Vendor
LiteLLM: Local file read vulnerability in vertex_ai_credentials
3 TTPs 1 CVEAn authenticated user with the internal_user_viewer role can read arbitrary local files from the LiteLLM proxy runtime by exploiting an incomplete blocklist in the vertex_ai_credentials parameter.
LiteLLM: Supply chain compromise of version 1.107.0
1 rule 4 TTPs 1 IOCThe LiteLLM Python package version 1.107.0 was compromised via stolen GitHub CLI OAuth tokens to distribute a credential-stealing backdoor that harvests cloud and developer secrets.
Weak Authentication Vulnerability in LiteLLM (CVE-2026-93355)
2 TTPs 1 CVELiteLLM contains a critical authentication flaw where failure to validate JWT email claims allows attackers to impersonate arbitrary users and escalate to administrative privileges.
Security Bypass Vulnerability in LiteLLM
3 TTPs 1 CVEA vulnerability in LiteLLM, tracked as CVE-2024-4786, allows remote authenticated attackers to circumvent established security controls.
LiteLLM Vulnerability Allows Remote Code Execution with Service Privileges
2 TTPsA remote, authenticated attacker can exploit a vulnerability in LiteLLM to execute arbitrary program code with the privileges of the service.
LiteLLM Multiple Vulnerabilities Allow Privilege Escalation
2 rules 1 TTPA remote, authenticated attacker can exploit multiple vulnerabilities in LiteLLM to escalate their privileges.
LiteLLM Privilege Escalation via /user/update Endpoint (CVE-2026-47102)
2 rules 1 TTP 1 CVECVE-2026-47102 describes a privilege escalation vulnerability in LiteLLM versions prior to 1.83.10, where the /user/update endpoint allows users to modify their own user_role, potentially escalating their privileges to proxy_admin.
LiteLLM Privilege Escalation via API Key Creation (CVE-2026-47101)
2 rules 1 TTP 1 CVELiteLLM versions prior to 1.83.14 allow an authenticated internal user to create API keys that bypass role-based access controls, potentially leading to full privilege escalation to proxy_admin due to a lack of verification of specified routes within the user's own permissions (CVE-2026-47101).
LiteLLM SQL Injection Vulnerability (CVE-2025-45809)
2 rules 1 TTP 1 IOCA SQL Injection vulnerability (CVE-2025-45809) in LiteLLM versions prior to 1.81.0 allows unauthenticated attackers to potentially steal database contents and read server files via time-based blind SQL injection in the `/key/block` and `/key/unblock` endpoints.
LiteLLM Multiple Vulnerabilities
2 rules 2 TTPsMultiple vulnerabilities in LiteLLM could allow an attacker to perform a SQL injection attack and gain unauthorized access or execute arbitrary code with the privileges of the service.
TeamPCP Targets LiteLLM Package on PyPI
2 rules 3 TTPsTeamPCP, the threat actor behind previous compromises of Trivy and KICS, has now targeted LiteLLM, a popular Python package on PyPI with 95 million monthly downloads.