{"id":"GHSA-2rwg-2wh4-7c4f","kind":"vulnerability","aliases":["GHSA-2rwg-2wh4-7c4f"],"related":[],"title":"Authenticated secret exfiltration via Azure Entra credential parameters in the request body","description":"### Summary\r\n\r\nThis vulnerability affects only deployments with at least one Azure OpenAI (`azure/`) or Azure AI (`azure_ai/`) model, and which do not have `AZURE_API_KEY` or `AZURE_OPENAI_API_KEY` environment variables set.\r\n\r\nThe request body blocklist in the LiteLLM proxy does not cover the Azure Entra ID credential parameters (`tenant_id`, `client_id`, `client_secret`, `azure_username`, `azure_password` and `azure_scope`). An authenticated caller can send them in a normal `POST /v1/chat/completions` or `POST /v1/images/generations` body for an Azure deployment, and the values override the Azure credential the deployment would otherwise use. A caller can set the request's `client_id` to a reference that points at a server-side environment variable, such as `LITELLM_MASTER_KEY`. Entra then rejects the resolved value as an unknown application and the proxy returns that error to the caller with the resolved value in it.\r\n\r\n### Impact\r\n\r\nA low-privilege authenticated user with access to at least one Azure OpenAI (`azure/`) or Azure AI (`azure_ai/`) model can read environment variables of the proxy process and the contents of files that an environment variable points to. On a typical deployment this includes the database connection URL, provider API keys and `LITELLM_MASTER_KEY`. Reading the master key gives full proxy admin control.\r\n\r\n### Pre-upgrade Workaround\r\n\r\n* Block the six parameters in request bodies at a reverse proxy or API gateway in front of LiteLLM.","summary":"LiteLLM proxy accepts Azure Entra credential parameters in normal chat and image request bodies, letting a caller override the deployment's Azure credential. A crafted reference to a server environment variable such as LITELLM_MASTER_KEY gets echoed back in the error response.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"litellm","fixed":["1.106.9"],"affected":"< 1.106.9","ecosystem":"pypi"},{"name":"litellm","fixed":["1.108.6"],"affected":"< 1.108.6","ecosystem":"pypi"},{"name":"litellm","fixed":["1.109.1"],"affected":"< 1.109.1","ecosystem":"pypi"},{"name":"litellm","fixed":["1.110.0-rc.2"],"affected":"< 1.110.0-rc.2","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-tooling","azure-openai","cwe-184","cwe-209","litellm","python","self-hosted"],"not_affected_if":["azure-api-key-env-set","no-azure-models","upgraded"],"how_to_check":"- Check whether any `azure/` or `azure_ai/` model is configured in the LiteLLM proxy config.\n- Check whether `AZURE_API_KEY` and `AZURE_OPENAI_API_KEY` are both unset in the proxy environment.\n- Check the installed litellm version with `pip show litellm`; affected versions are below `1.106.9`, `1.108.6`, `1.109.1`, and `1.110.0-rc.2` depending on branch.","fix":"- `litellm` `1.106.9` on the 1.106 line\n- `litellm` `1.108.6` on the 1.108 line\n- `litellm` `1.109.1` on the 1.109 line\n- `litellm` `1.110.0-rc.2` on the 1.110 line","status":"open","published_at":"2026-11-12T09:50:25+00:00","first_seen_at":"2026-11-12T09:54:03+00:00","triaged_at":"2026-11-12T09:55:53+00:00","updated_at":"2026-11-12T09:55:53+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-11-12T09:55:53Z","model":"claude-haiku-5-5","output":{"fix":"- `litellm` `1.106.9` on the 1.106 line\n- `litellm` `1.108.6` on the 1.108 line\n- `litellm` `1.109.1` on the 1.109 line\n- `litellm` `1.110.0-rc.2` on the 1.110 line","reach":"network","title":"LiteLLM: Azure credential fields in request body leak server secrets","impact":"high","summary":"LiteLLM proxy accepts Azure Entra credential parameters in normal chat and image request bodies, letting a caller override the deployment's Azure credential. A crafted reference to a server environment variable such as LITELLM_MASTER_KEY gets echoed back in the error response.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["litellm","python","self-hosted","azure-openai"],"confidence":0.85,"fix_status":"available","needs_auth":"yes","worst_case":"Server environment variables and secrets readable, including master key","analyst_note":"","how_to_check":"- Check whether any `azure/` or `azure_ai/` model is configured in the LiteLLM proxy config.\n- Check whether `AZURE_API_KEY` and `AZURE_OPENAI_API_KEY` are both unset in the proxy environment.\n- Check the installed litellm version with `pip show litellm`; affected versions are below `1.106.9`, `1.108.6`, `1.109.1`, and `1.110.0-rc.2` depending on branch.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-azure-models","azure-api-key-env-set","upgraded"],"who_is_affected":"Deployments of the LiteLLM proxy that have at least one Azure OpenAI or Azure AI model and do not set `AZURE_API_KEY` or `AZURE_OPENAI_API_KEY` in the environment. Any authenticated user with access to such a model can exploit it through a normal chat or image request. Deployments with no Azure models, or with those API key variables set, are not described as affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000884,"input_tokens":5148,"output_tokens":739,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-184':34B '-209':36B '/v1/chat/completions':160C '/v1/images/generations':163C '2rwg':15A,20A '2wh4':16A,21A '7c4f':17A,22A 'accept':44B 'access':240C 'admin':297C 'affect':88C 'ai':28B,100C,102C,250C,252C 'ai-tool':27B 'api':110C,115C,284C,315C 'applic':216C 'authent':1A,151C,237C 'azur':5A,31B,45B,63B,95C,97C,99C,101C,109C,113C,132C,143C,145C,148C,167C,174C,245C,247C,249C,251C 'azure-openai':30B 'back':80B 'block':303C 'blocklist':123C 'bodi':12A,55B,122C,164C,309C 'caller':58B,152C,182C,225C 'chat':51B 'client':139C,141C,188C 'connect':281C 'content':264C 'control':298C 'cover':130C 'craft':66B 'credenti':7A,47B,64B,135C,175C 'cwe':33B,35B 'databas':280C 'deploy':61B,90C,168C,177C,276C 'echo':79B 'entra':6A,46B,133C,207C 'environ':71B,117C,200C,256C,269C 'error':83B,222C 'exfiltr':3A 'file':266C 'front':318C 'full':295C 'gateway':316C 'get':78B 'ghsa':14A,19A 'ghsa-2rwg-2wh4-7c4f':13A,18A 'give':294C 'host':41B 'id':134C,138C,140C,189C 'imag':53B 'impact':232C 'includ':278C 'key':77B,111C,116C,206C,285C,289C,293C 'least':93C,243C 'let':56B 'litellm':23A,24A,25A,26A,37B,42B,75B,126C,204C,287C,320C 'low':235C 'low-privileg':234C 'master':76B,205C,288C,292C 'model':103C,253C 'normal':50B,158C 'one':94C,244C 'openai':32B,96C,114C,246C 'otherwis':179C 'overrid':59B,172C 'paramet':8A,48B,136C,306C 'password':146C 'point':194C,271C 'post':159C,162C 'pre':300C 'pre-upgrad':299C 'privileg':236C 'process':261C 'provid':283C 'proxi':43B,127C,219C,260C,296C,313C 'python':38B 'read':255C,290C 'refer':67B,192C 'reject':209C 'request':11A,54B,121C,186C,308C 'resolv':211C,228C 'respons':84B 'return':220C 'revers':312C 'scope':149C 'secret':2A,142C 'self':40B 'self-host':39B 'send':154C 'server':70B,198C 'server-sid':197C 'set':119C,184C 'side':199C 'six':305C 'summari':85C 'tenant':137C 'tool':29B 'typic':275C 'unknown':215C 'upgrad':301C 'url':282C 'use':180C 'user':238C 'usernam':144C 'valu':171C,212C,229C 'variabl':72B,118C,201C,257C,270C 'via':4A 'vulner':87C 'workaround':302C 'would':178C","nicknames":[],"mitigations":[],"who_affected":"Deployments of the LiteLLM proxy that have at least one Azure OpenAI or Azure AI model and do not set `AZURE_API_KEY` or `AZURE_OPENAI_API_KEY` in the environment. Any authenticated user with access to such a model can exploit it through a normal chat or image request. Deployments with no Azure models, or with those API key variables set, are not described as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["litellm"],"ptokens":["litellm"],"labels":["aitooling","azureopenai","cwe184","cwe209","high","litellm","pypi","python","selfhosted"],"campaign_type":null,"search_a":"'2rwg':15A,20A '2wh4':16A,21A '7c4f':17A,22A 'authent':1A 'azur':5A 'bodi':12A 'credenti':7A 'entra':6A 'exfiltr':3A 'ghsa':14A,19A 'ghsa-2rwg-2wh4-7c4f':13A,18A 'litellm':23A,24A,25A,26A 'paramet':8A 'request':11A 'secret':2A 'via':4A","search_b":"'-184':34B '-209':36B 'accept':44B 'ai':28B 'ai-tool':27B 'azur':31B,45B,63B 'azure-openai':30B 'back':80B 'bodi':55B 'caller':58B 'chat':51B 'craft':66B 'credenti':47B,64B 'cwe':33B,35B 'deploy':61B 'echo':79B 'entra':46B 'environ':71B 'error':83B 'get':78B 'host':41B 'imag':53B 'key':77B 'let':56B 'litellm':37B,42B,75B 'master':76B 'normal':50B 'openai':32B 'overrid':59B 'paramet':48B 'proxi':43B 'python':38B 'refer':67B 'request':54B 'respons':84B 'self':40B 'self-host':39B 'server':70B 'tool':29B 'variabl':72B","search_c":"'/v1/chat/completions':160C '/v1/images/generations':163C 'access':240C 'admin':297C 'affect':88C 'ai':100C,102C,250C,252C 'api':110C,115C,284C,315C 'applic':216C 'authent':151C,237C 'azur':95C,97C,99C,101C,109C,113C,132C,143C,145C,148C,167C,174C,245C,247C,249C,251C 'block':303C 'blocklist':123C 'bodi':122C,164C,309C 'caller':152C,182C,225C 'client':139C,141C,188C 'connect':281C 'content':264C 'control':298C 'cover':130C 'credenti':135C,175C 'databas':280C 'deploy':90C,168C,177C,276C 'entra':133C,207C 'environ':117C,200C,256C,269C 'error':222C 'file':266C 'front':318C 'full':295C 'gateway':316C 'give':294C 'id':134C,138C,140C,189C 'impact':232C 'includ':278C 'key':111C,116C,206C,285C,289C,293C 'least':93C,243C 'litellm':126C,204C,287C,320C 'low':235C 'low-privileg':234C 'master':205C,288C,292C 'model':103C,253C 'normal':158C 'one':94C,244C 'openai':96C,114C,246C 'otherwis':179C 'overrid':172C 'paramet':136C,306C 'password':146C 'point':194C,271C 'post':159C,162C 'pre':300C 'pre-upgrad':299C 'privileg':236C 'process':261C 'provid':283C 'proxi':127C,219C,260C,296C,313C 'read':255C,290C 'refer':192C 'reject':209C 'request':121C,186C,308C 'resolv':211C,228C 'return':220C 'revers':312C 'scope':149C 'secret':142C 'send':154C 'server':198C 'server-sid':197C 'set':119C,184C 'side':199C 'six':305C 'summari':85C 'tenant':137C 'typic':275C 'unknown':215C 'upgrad':301C 'url':282C 'use':180C 'user':238C 'usernam':144C 'valu':171C,212C,229C 'variabl':118C,201C,257C,270C 'vulner':87C 'workaround':302C 'would':178C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T09:50:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-2rwg-2wh4-7c4f","url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-2rwg-2wh4-7c4f","severity":"high","published_at":"2026-11-12T09:50:25+00:00","modified_at":"2026-11-12T09:50:26+00:00","first_seen_at":"2026-11-12T09:54:03+00:00","fetched_at":"2026-11-12T10:09:07+00:00","note":null}],"documents":[{"id":133724,"url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-2rwg-2wh4-7c4f","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}