---
id: "GHSA-2rwg-2wh4-7c4f"
page: "https://infrastack.ai/live/GHSA-2rwg-2wh4-7c4f"
kind: "vulnerability"
aliases: ["GHSA-2rwg-2wh4-7c4f"]
title: "Authenticated secret exfiltration via Azure Entra credential parameters in the request body"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "litellm", "fixed": ["1.106.9"], "affected": "< 1.106.9", "ecosystem": "pypi"}, {"name": "litellm", "fixed": ["1.108.6"], "affected": "< 1.108.6", "ecosystem": "pypi"}, {"name": "litellm", "fixed": ["1.109.1"], "affected": "< 1.109.1", "ecosystem": "pypi"}, {"name": "litellm", "fixed": ["1.110.0-rc.2"], "affected": "< 1.110.0-rc.2", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["ai-tooling", "azure-openai", "cwe-184", "cwe-209", "litellm", "python", "self-hosted"]
not_affected_if: ["azure-api-key-env-set", "no-azure-models", "upgraded"]
published_at: "2026-11-12T09:50:25+00:00"
first_seen_at: "2026-11-12T09:54:03+00:00"
updated_at: "2026-11-12T09:55:53+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/BerriAI/litellm/security/advisories/GHSA-2rwg-2wh4-7c4f", "first_seen_at": "2026-11-12T09:54:03+00:00"}]
exploit_sources: []
---

# Authenticated secret exfiltration via Azure Entra credential parameters in the request body

Link for people: https://infrastack.ai/live/GHSA-2rwg-2wh4-7c4f (this .md is for agents)

LiteLLM proxy accepts Azure Entra credential parameters in normal chat and image request bodies, letting a caller override the deployment's Azure credential. A crafted reference to a server environment variable such as LITELLM_MASTER_KEY gets echoed back in the error response.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:litellm affected < 1.106.9 fixed 1.106.9
- pypi:litellm affected < 1.108.6 fixed 1.108.6
- pypi:litellm affected < 1.109.1 fixed 1.109.1
- pypi:litellm affected < 1.110.0-rc.2 fixed 1.110.0-rc.2

## How to check

- Check whether any `azure/` or `azure_ai/` model is configured in the LiteLLM proxy config.
- Check whether `AZURE_API_KEY` and `AZURE_OPENAI_API_KEY` are both unset in the proxy environment.
- Check the installed litellm version with `pip show litellm`; affected versions are below `1.106.9`, `1.108.6`, `1.109.1`, and `1.110.0-rc.2` depending on branch.

## Fix

- `litellm` `1.106.9` on the 1.106 line
- `litellm` `1.108.6` on the 1.108 line
- `litellm` `1.109.1` on the 1.109 line
- `litellm` `1.110.0-rc.2` on the 1.110 line

## Timeline

- 2026-11-12T09:54:03+00:00 ghsa-repo https://github.com/BerriAI/litellm/security/advisories/GHSA-2rwg-2wh4-7c4f

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/BerriAI/litellm/security/advisories/GHSA-2rwg-2wh4-7c4f

## From the sources

### Summary

This vulnerability affects only deployments with at least one Azure OpenAI (`azure/`) or Azure AI (`azure_ai/`) model, and which do not have `AZURE_API_KEY` or `AZURE_OPENAI_API_KEY` environment variables set.

The request body blocklist in the LiteLLM proxy does not cover the Azure Entra ID credential parameters (`tenant_id`, `client_id`, `client_secret`, `azure_username`, `azure_password` and `azure_scope`). An authenticated caller can send them in a normal `POST /v1/chat/completions` or `POST /v1/images/generations` body for an Azure deployment, and the values override the Azure credential the deployment would otherwise use. A caller can set the request's `client_id` to a reference that points at a server-side environment variable, such as `LITELLM_MASTER_KEY`. Entra then rejects the resolved value as an unknown application and the proxy returns that error to the caller with the resolved value in it.

### Impact

A low-privilege authenticated user with access to at least one Azure OpenAI (`azure/`) or Azure AI (`azure_ai/`) model can read environment variables of the proxy process and the contents of files that an environment variable points to. On a typical deployment this includes the database connection URL, provider API keys and `LITELLM_MASTER_KEY`. Reading the master key gives full proxy admin control.

### Pre-upgrade Workaround

* Block the six parameters in request bodies at a reverse proxy or API gateway in front of LiteLLM.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_