A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file litellm/proxy/experimental/mcpserver/auth/userapikeyauthmcp.py of the component MCP Proxy. Executing a manipulation can lead to improper authentication. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

A vulnerability was determined in BerriAI litellm up to 1.82.2. This affects the function json.dumps of the file litellm/proxy/managementendpoints/uisso.py of the component SSO Debug Flow. Executing a manipulation can lead to missing authentication. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function executewithmcpclient of the file litellm/proxy/experimental/mcpserver/restendpoints.py of the component MCP Server Connection Testing. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

A weakness has been identified in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function loadopenapispecasync of the file litellm/proxy/experimental/mcpserver/openapitomcpgenerator.py of the component MCP OpenAPI Spec Loader. This manipulation of the argument specpath causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

A security flaw has been discovered in BerriAI litellm up to 1.82.5. Affected is the function asyncprecallhook of the file enterprise/enterprisehooks/bannedkeywords.py of the component Completions Interface. The manipulation of the argument prompt results in incorrect authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.

A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this issue is the function uiviewusers of the file litellm/proxy/managementendpoints/internaluserendpoints.py of the component Incomplete Fix CVE-2025-0628. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

A vulnerability was identified in BerriAI litellm up to 1.82.2. This impacts the function getredirectresponsefromopenid of the file litellm/proxy/managementendpoints/uisso.py of the component SSO Authentication Flow. The manipulation leads to session expiration. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/userapikeyauth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

On 3/23/26 07:31, Jeremy Utiera wrote: Of note, this attack is still on-going and the extent of Trivy's compromise seems to be growing. And it appears they were able to leverage the Trivy compromise to compromise other packages as well.

https://github.com/BerriAI/litellm/issues/24512 and https://github.com/BerriAI/litellm/issues/24518 report that litellm PyPI packages v1.82.7 + v1.82.8 were compromised:

The litellm==1.82.8 wheel package on PyPI contains a malicious .pth file (litellminit.pth, 34,628 bytes) that automatically executes a credential- stealing script every time the Python interpreter starts — no import litellm required.

Anyone who installed litellm==1.82.8 via pip has had all environment variables, SSH keys, cloud credentials, and other secrets collected and sent to an attacker-controlled server.

-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris

The python package 'litellm' was compromised (apparently via the earlier trivy compromise) and a malicious version included code to steal credentials and install a backdoor.

https://github.com/BerriAI/litellm/issues/24512 https://github.com/advisories/GHSA-5mg7-485q-xm76

https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/

Full PYSEC-2026-2 advisory below:

https://osv.dev/vulnerability/PYSEC-2026-2

--- Import Source https://github.com/pypa/advisory-database/blob/main/vulns/litellm/PYSEC-2026-2.yaml

JSON Data https://api.osv.dev/v1/vulns/PYSEC-2026-2

Aliases MAL-2026-2144

Published 2026-03-24T16:15:08.809028Z

Modified 2026-03-24T22:41:32.746566Z

Summary Two litellm versions published containing credential harvesting malware

Details

After an API Token exposure from an exploited Trivy dependency, two new releases of litellm were uploaded to PyPI containing automatically activated malware, harvesting sensitive credentials and files, and exfiltrating to a remote API.

The malicious code runs during importing any module from the package and scans the file system and environment variables, collecting all kinds of sensitive data, including but not limited to private SSH keys, credentials to Git and Docker repositories, dotenv files, tokens to Kubernetes service accounts, databases and LDAP configuration. Also exfiltrated are multiple shell history files and cryptowallet keys. The malware actively attempts to obtain cloud access tokens from metadata servers and retrieve secrets stored in AWS Secrets Manager. All collected data are sent to the domain models.litellm[.]cloud

Furthermore, the code includes a persistence mechanism by configuring a SystemD service unit masqueraded as "System Telemetry Service" on the host it runs on, and in a Kubernetes environment also by creating a new pod. The persistence script then contacts hxxps://checkmarx[.]zone/raw for further instructions.

Anyone who has installed and run the project should assume any credentials available to litellm environment may have been exposed, and revoke/rotate them accordingly. The affected environment should be isolated and carefully reviewed against any unexpected modifications and network traffic.

References https://inspector.pypi.io/project/litellm/1.82.8/packages/f6/2c/731b614e6cee0bca1e010a36fd381fba69ee836fe3cb6753ba23ef2b9601/litellm-1.82.8.tar.gz/litellm-1.82.8/litellminit.pth#line.1 https://inspector.pypi.io/project/litellm/1.82.7/packages/79/5f/b6998d42c6ccd32d36e12661f2734602e72a576d52a51f4245aef0b20b4d/litellm-1.82.7-py3-none-any.whl/litellm/proxy/proxyserver.py#line.130 https://github.com/BerriAI/litellm/issues/24518 https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/ https://www.wiz.io/blog/teampcp-attack-kics-github-action

Credits Callum McMahon, Futuresearch - REPORTER Mike Fiedler - COORDINATOR Kamil Mańkowski - ANALYST

Affected packages

PyPI / litellm

Package

Name litellm View open source insights on deps.dev

Purl pkg:pypi/litellm

Affected ranges

Type ECOSYSTEM

Events Introduced 1.82.7 Last affected 1.82.8

Affected versions

1. 1.82.7 1.82.8

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/litellm/PYSEC-2026-2.yaml";

PYSEC-2026-2 - OSV