LITELLM · GHSA-2rwg-2wh4-7c4f · AI agents & MCP
FIX → 1.110.0-rc.2 +3
LiteLLM proxy accepts Azure Entra credential parameters in normal chat and image request bodies, letting a caller override the deployment's Azure credential. A crafted reference to a server environment variable such as LITELLM_MASTER_KEY gets echoed back in the error response.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Deployments of the LiteLLM proxy that have at least one Azure OpenAI or Azure AI model and do not set AZURE_API_KEY or AZURE_OPENAI_API_KEY in the environment. Any authenticated user with access to such a model can exploit it through a normal chat or image request. Deployments with no Azure models, or with those API key variables set, are not described as affected.
Not affected if azure-api-key-env-set, no-azure-models, upgraded
Who cares azure-openai, litellm, python, self-hosted
azure/ or azure_ai/ model is configured in the LiteLLM proxy config.This vulnerability affects only deployments with at least one Azure OpenAI (azure/) or Azure AI (azure_ai/) model, and which do not have AZURE_API_KEY or AZURE_OPENAI_API_KEY environment variables set.
The request body blocklist in the LiteLLM proxy does not cover the Azure Entra ID credential parameters (tenant_id, client_id, client_secret, azure_username, azure_password and azure_scope). An authenticated caller can send them in a normal POST /v1/chat/completions or POST /v1/images/generations body for an Azure deployment, and the values override the Azure credential the deployment would otherwise use. A caller can set the request's client_id to a reference that points at a server-side environment variable, such as . Entra then rejects the resolved value as an unknown application and the proxy returns that error to the caller with the resolved value in it.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
AZURE_API_KEY and AZURE_OPENAI_API_KEY are both unset in the proxy environment.pip show litellm; affected versions are below 1.106.9, 1.108.6, 1.109.1, and 1.110.0-rc.2 depending on branch.Upgrade to 1.110.0-rc.2 +3
litellm 1.106.9 on the 1.106 linelitellm 1.108.6 on the 1.108 linelitellm 1.109.1 on the 1.109 linelitellm 1.110.0-rc.2 on the 1.110 lineLITELLM_MASTER_KEYA low-privilege authenticated user with access to at least one Azure OpenAI (azure/) or Azure AI (azure_ai/) model can read environment variables of the proxy process and the contents of files that an environment variable points to. On a typical deployment this includes the database connection URL, provider API keys and LITELLM_MASTER_KEY. Reading the master key gives full proxy admin control.