Authorization Bypass Through User-Controlled Key Affecting litellm package, versions [1.93.0.dev2,]
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Authorization Bypass Through User-Controlled Key vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PYTHON-LITELLM-20840174
- published12 Oct 2026
- disclosed11 Oct 2026
- creditGabriel Alves
Introduced: 11 Oct 2026
NewCVE-2026-108575 (opens in a new tab)How to fix?
There is no fixed version for litellm.
Overview
litellm is a Library to easily interface with LLM API providers
Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the add_new_model and can_user_make_team_model_call functions in model_management_endpoints.py, which authorize the caller by role alone and never inspect the values supplied in litellm_params. A user with team administrator access can read any environment variable of the proxy process, including the proxy master key, by registering a model whose api_key is an os.environ/<NAME> reference and whose api_base points to a host they control, then invoking it so that get_secret resolves the variable and _resolve_db_litellm_param sends it to that host as the outbound Authorization header. This requires STORE_MODEL_IN_DB to be enabled and an enterprise license, which is what makes the team administrator role available.
Note: A fix is unlikely. In https://github.com/BerriAI/litellm/commit/5862be3e79154ce5ac8a736c77c7c3614fac40fb, project maintainers removed the field whitelist and the team-scope short-circuit in _resolve_db_litellm_param deliberately, describing universal os.environ/ resolution for team-scoped rows as an intended threat-model expansion that trusts team administrators to read environment variables, and placing the trust boundary on who the deployment grants team administrator rather than on what those administrators may reference.