REDHAT-BUG-2480635: High severity LiteLLM vulnerability
LiteLLM prior to 1.83.14 allows an authenticated internaluser to create API keys with access to routes that their role does not permit. When generating a key, the allowedroutes field is stored without verifying that the specified routes fall within the user's own permissions. A key created with access to admin-only routes can then be used to reach those routes successfully, bypassing the role-based access controls that would otherwise block the request, enabling full privilege escalation from internaluser to proxyadmin.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LiteLLMto a version that resolves this vulnerability.Fixed in 1.83.14
Event History
Frequently Asked Questions
Which users could exploit this issue?
An authenticated user assigned the internal_user role could exploit it. The issue allows that role to escalate to proxy_admin by creating and using a specially permitted API key.
What LiteLLM versions are affected?
LiteLLM versions prior to 1.83.14 are affected. Version 1.83.14 is the stated boundary for this issue.