Information Exposure Affecting litellm package, versions [,1.80.11)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-LITELLM-14807072
- published1 Jan 2026
- disclosed1 Jan 2026
- creditUnknown
Introduced: 1 Jan 2026
CVE NOT AVAILABLE CWE-209 (opens in a new tab)How to fix?
Upgrade litellm to version 1.80.11 or higher.
Overview
litellm is a Library to easily interface with LLM API providers
Affected versions of this package are vulnerable to Information Exposure due to improper masking of raw request headers in the pre_call method of litellm/litellm_core_utils/litellm_logging.py. An attacker can obtain exposed API keys by triggering failures on the /health endpoint, which causes unmasked Authorization headers containing credentials to be included in the error response via raw_request_typed_dict.
Note: Successful exploitation of this vulnerability requires the attacker to have access to the network traffic.