LITELLM · GHSA-w4c7-34wj-hqm8 · AI agents & MCP
FIX → 1.106.5 +3
A LiteLLM proxy running with an Enterprise license can be made to read a local file, such as /proc/self/environ, and send its contents to an attacker-chosen URL. The leaked file exposes LITELLM_MASTER_KEY and provider API keys, giving the attacker full admin access to the proxy, and in some configurations arbitrary Python code execution as root.
first public Oct 27, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only LiteLLM proxy deployments running with an Enterprise license are affected, since the vulnerable code paths load only when a license is active. The advisory says any LLM route on the proxy can trigger it without authentication, so an exposed proxy is the main concern. Teams that keep the proxy off the public internet and restrict its outbound traffic to provider endpoints reduce exposure, but the advisory still recommends updating.
Not affected if managed-hosting, open-source-no-license
Who cares enterprise-license, litellm, python, self-hosted
pip show litellm and compare it with the fixed versions below.An unauthenticated request to any LLM route on a LiteLLM proxy running with an Enterprise license could make the proxy read a local file and send its contents to a URL chosen by the attacker. Reading a file like /proc/self/environ exposes LITELLM_MASTER_KEY and provider API keys, which gives the attacker full admin access to the proxy. In some configurations, this allows the attacker to then execute arbitrary python code as root.
Open source deployments without a license are not affected, because the relevant codepaths only load when an Enterprise license is active. As defense in depth, we also recommend loading the master key from a secret manager instead of the process environment, setting a separate LITELLM_SALT_KEY, and limiting the proxy's outbound traffic to known provider endpoints.
If you cannot update immediately, consider implementing the following:
standard_callback_dynamic_paramsgcs_path_service_accountcallbackssuccess_callbackCheck it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 1.106.5 +3
litellm 1.103.10 on the 1.103 linelitellm 1.104.8 on the 1.104 linelitellm 1.105.6 on the 1.105 linelitellm 1.106.5 on the 1.106 linefailure_callbackSeparately, we generally recommend keeping the proxy off the public internet where possible (e.g. via VPN, mTLS, an authenticating ingress, or an IP allowlist).
Originally discovered and reported by Dylan Ong at Karmasec - https://karmasec.io/ Independently discovered and reported by Cyrill Bannwart - Compass Security