A security flaw has been discovered in BerriAI litellm up to 1.82.2. This impacts the function authenticateuser of the file litellm/proxy/auth/loginutils.py of the component PROXYADMIN database API Key Generator. Performing a manipulation results in session expiration. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.

A vulnerability was determined in BerriAI litellm up to 1.63.1. The impacted element is an unknown function of the file litellm/proxy/managementendpoints/keymanagementendpoints.py of the component Admin Key Handler. This manipulation causes improper authorization. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 23781. It is recommended to apply a patch to fix this issue. The vendor was contacted early about this disclosure.

BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host.

BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages.

X41 D-Sec GmbH Security Advisory: X41-2026-001

Guardrail Sandbox Escape in LiteLLM ======================

Severity Rating: High Confirmed Patched Versions: N/A

Vendor: BerriAI

Vendor URL: https://github.com/BerriAI/litellm

Vendor Reference: N/A

Vector: Authenticated HTTP API request

Credit: X41 D-Sec GmbH, Markus Vervier

Status: Public

CVE: N/A

CWE: CWE-94 (Improper Control of Generation of Code / Code Injection)

CVSS Score: 8.7

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Advisory URL: <https://www.x41-dsec.de/lab/advisories/x41-2026-001-litellm/>

Summary and Impact ==================

Product Description =================== Analysis ======== The bypass works in 6 steps:

Proof of Concept ================

The following sets up a vulnerable test environment:

curl -s -X POST \       -H "Authorization: Bearer sk-litellm-master-key" \       -H "Content-Type: application/json" \       http://localhost:4000/guardrails/testcustomcode \       -d '{ "testinput": {"messages": [{"role": "user", "content": "test"}]}       }'

Workarounds =========== Timeline ========

2026-02-13 Issue identified, PoC created 2026-03-20 Follow-up sent for patch status and disclosure coordination 2026-03-25 Looped in distros mailing list and additional contacts at berry 2026-03-26 Berry acknowledged the report receipt again 2026-04-07 X41 and distros clarified the embargo runs out on 2026-04-08 2026-04-08 Distros maximum embargo expired, publication

About X41 D-Sec GmbH ====================

X41 is an expert provider for application security services. X41 to perform premium security services. code reviews, binary reverse engineering and vulnerability discovery. Custom research and IT security consulting and support services are core competencies of X41.

SQL Injection vulnerability in BerriAI LiteLLM before 1.81.0 allows attackers to execute arbitrary commands via the key parameter to the "/key/block" and "/key/unblock" API endpoints.

BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the 'postcallrules' configuration, where a callback function can be added. The provided value is split at the final '.' mark, with the last part considered the function name and the remaining part appended with the '.py' extension and imported. This allows an attacker to set a system method, such as 'os.system', as a callback, enabling the execution of arbitrary commands when a chat response is processed.

A vulnerability in BerriAI/litellm, as of commit 26c03c9, allows unauthenticated users to cause a Denial of Service (DoS) by exploiting the use of ast.literaleval to parse user input. This function is not safe and is prone to DoS attacks, which can crash the litellm Python server.

An improper authorization vulnerability exists in the main-latest version of BerriAI/litellm. When a user with the role 'internaluserviewer' logs into the application, they are provided with an overly privileged API key. This key can be used to access all the admin functionality of the application, including endpoints such as '/users/list' and '/users/getusers'. This vulnerability allows for privilege escalation within the application, enabling any account to become a PROXY ADMIN.

In berriai/litellm version v1.52.1, an issue in proxyserver.py causes the leakage of Langfuse API keys when an error occurs while parsing team settings. This vulnerability exposes sensitive information, including langfusesecret and langfusepublickey, which can provide full access to the Langfuse project storing all requests.

In berriai/litellm before version 1.44.12, the litellm/litellmcoreutils/litellmlogging.py file contains a vulnerability where the API key masking code only masks the first 5 characters of the key. This results in the leakage of almost the entire API key in the logs, exposing a significant amount of the secret key. The issue affects version v1.44.9.

A Denial of Service (DoS) vulnerability exists in berriai/litellm version v1.44.5. This vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. The server continuously processes each character, leading to excessive resource consumption and rendering the service unavailable. The issue is unauthenticated and does not require any user interaction, impacting all users of the service.