CVE-2025-0330: Exposure of Sensitive Information in berriai/litellm
In berriai/litellm version v1.52.1, an issue in proxyserver.py causes the leakage of Langfuse API keys when an error occurs while parsing team settings. This vulnerability exposes sensitive information, including langfusesecret and langfusepublickey, which can provide full access to the Langfuse project storing all requests.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0330?
CVE-2025-0330 is classified as a high severity vulnerability due to the potential exposure of sensitive API keys.
How do I fix CVE-2025-0330?
To fix CVE-2025-0330, update to the latest version of berriai/litellm where the vulnerability has been addressed.
What information is leaked by CVE-2025-0330?
CVE-2025-0330 leaks sensitive information such as Langfuse API keys, specifically langfuse_secret and langfuse_public_key.
Which versions of berriai/litellm are affected by CVE-2025-0330?
CVE-2025-0330 affects version v1.52.1 of berriai/litellm and earlier versions.
How can I mitigate the risks associated with CVE-2025-0330?
Mitigation for CVE-2025-0330 includes reviewing access controls and updating to the patched software version to prevent sensitive data leakage.