CVE-2026-108596: OpenLIT 2.1.0 Authorization Bypass via x-openlit-project-id Header
OpenLIT 2.1.0 contains an authorization bypass vulnerability that allows authenticated users to read other projects' telemetry by supplying a forged x-openlit-project-id header. Attackers who know a victim project id and database config id can query the trace read API to obtain traces including LLM prompts and completions.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must be an authenticated OpenLIT user and must know both a victim project ID and a database configuration ID. They can then forge the x-openlit-project-id header when querying the trace read API.
What data could be exposed?
An attacker can read telemetry traces belonging to other projects, including LLM prompts and completions.
Are unauthenticated users affected?
The available information describes exploitation by authenticated users. It does not indicate that unauthenticated access is sufficient.