CVE-2026-108574: LiteLLM: IDOR in spend logs exposes session data

MEDIUMCISA: TRACK*

Published October 11, 2026

CISO Take

A flaw in LiteLLM's Spend Tracking component (up to 1.95.0) lets an authenticated user manipulate the session_id parameter in ui_view_session_spend_logs to read spend logs belonging to other sessions, a classic insecure direct object reference (CWE-639, CWE-285). Severity is medium (CVSS 4.3) because it needs a valid low-privilege account and only exposes confidentiality at a limited level, with no EPSS data, no CISA KEV listing and no Nuclei template, though the vendor-style disclosure indicates a public exploit write-up exists and the attack is remote with low complexity. LiteLLM is widely deployed as a central LLM gateway, so leaked spend logs can reveal which models, teams and workloads are used, and potentially request metadata, across tenants; the package also has 46 other CVEs and 6 tracked dependents, which signals a recurring pattern worth weighing in risk reviews. Upgrade to LiteLLM 1.96.0 (patch commit 722d9ffa) and review proxy access logs for unusual session_id enumeration against the spend log endpoints.

Sources:NVDOpenSSFATLASvuldb.comgithub.com/BerriAI/litellm

What is the risk?

Medium risk. Exploitation is remote, low complexity and needs only low privileges and no user interaction, with impact limited to low confidentiality (no integrity or availability effect). The exploit is reported as published, raising likelihood somewhat, but there is no KEV listing, EPSS score or scanner template, so mass exploitation is not evident. Risk rises in multi-tenant LiteLLM proxy deployments where many teams or customers share one gateway and where logs contain prompts or sensitive metadata. Package context (risk score 79/100, OpenSSF 6/10, 46 other CVEs) suggests above-average exposure for the component overall.

How does the attack unfold?

Initial Access

Attacker authenticates to the LiteLLM proxy with a low-privilege account or virtual key.

AML.T0012

Exploitation

Attacker sends requests to the session spend logs endpoint with manipulated session_id values, bypassing ownership checks.

AML.T0049

Collection

Attacker enumerates session IDs and gathers spend log records belonging to other users or teams.

AML.T0036

Impact

Leaked usage and cost metadata exposes internal AI workloads and weakens tenant isolation.

Initial Access

Attacker authenticates to the LiteLLM proxy with a low-privilege account or virtual key.

AML.T0012

Exploitation

Attacker sends requests to the session spend logs endpoint with manipulated session_id values, bypassing ownership checks.

AML.T0049

Collection

Attacker enumerates session IDs and gathers spend log records belonging to other users or teams.

AML.T0036

Impact

Leaked usage and cost metadata exposes internal AI workloads and weakens tenant isolation.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LiteLLM	pip	—	No patch
62.0KOpenSSF 6.0Pushed 6d ago51% patched~47d to patchFull package profile →
LiteLLM	pip	—	No patch
62.0KOpenSSF 6.0Pushed 6d ago51% patched~47d to patchFull package profile →

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 15% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CLow

INone

ANone

What should I do?

1 step

1) Upgrade LiteLLM to 1.96.0 or later (fix commit 722d9ffa4f6c5ae15702ab9ab2c5f6bf1688308b). 2) Until patched, restrict access to the LiteLLM UI and spend log endpoints to trusted administrators via network controls or a reverse proxy, and limit issuance of low-privilege virtual keys or UI accounts. 3) Review proxy access logs for requests to the session spend log endpoints with many distinct session_id values from a single user or key. 4) Minimize sensitive content stored in spend logs (disable prompt and response logging where not needed) and rotate any keys or identifiers that may have been exposed. 5) Add LiteLLM to your SBOM and vulnerability monitoring, given the package's CVE history.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData LeakageAPIInferenceFrameworkAML.T0012- Valid Accounts AML.T0036- Data from Information Repositories AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown or newly identified risks

OWASP LLM Top 10

LLM02-Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-108574?

Is CVE-2026-108574 actively exploited?

No confirmed active exploitation of CVE-2026-108574 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-108574?

1) Upgrade LiteLLM to 1.96.0 or later (fix commit 722d9ffa4f6c5ae15702ab9ab2c5f6bf1688308b). 2) Until patched, restrict access to the LiteLLM UI and spend log endpoints to trusted administrators via network controls or a reverse proxy, and limit issuance of low-privilege virtual keys or UI accounts. 3) Review proxy access logs for requests to the session spend log endpoints with many distinct session_id values from a single user or key. 4) Minimize sensitive content stored in spend logs (disable prompt and response logging where not needed) and rotate any keys or identifiers that may have been exposed. 5) Add LiteLLM to your SBOM and vulnerability monitoring, given the package's CVE history.

What systems are affected by CVE-2026-108574?

This vulnerability affects the following AI/ML architecture patterns: LLM gateways and proxies, Model serving, Multi-tenant AI platforms, Agent frameworks.

What is the CVSS score for CVE-2026-108574?

CVE-2026-108574 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.24%.

What is the AI security impact?

Affected AI Architectures

LLM gateways and proxiesModel servingMulti-tenant AI platformsAgent frameworks

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0036Data from Information Repositories

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

A flaw has been found in BerriAI LiteLLM up to 1.95.0. Affected by this issue is the function ui_view_session_spend_logs of the file litellm/proxy/spend_tracking/spend_management_endpoints.py of the component Spend Tracking. Executing a manipulation of the argument session_id can lead to authorization bypass. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 1.96.0 can resolve this issue. This patch is called 722d9ffa4f6c5ae15702ab9ab2c5f6bf1688308b. The affected component should be upgraded.

Exploitation Scenario

An attacker holding a low-privilege LiteLLM account, such as a developer key or UI user in a shared AI gateway, calls the spend logs session view endpoint and substitutes other users' session_id values, guessed or enumerated. Because the function does not verify ownership of the session, the proxy returns spend log records for other teams, revealing models used, token volumes, costs and any logged request metadata. The attacker uses this to map internal AI usage, identify high-value projects and plan further attacks or competitive intelligence gathering.

Weaknesses (CWE)

CWE-285Improper AuthorizationPrimary CWE-639Authorization Bypass Through User-Controlled KeyPrimary CWE-285Improper Authorization CWE-639Authorization Bypass Through User-Controlled Key

CWE-285 — Improper Authorization: The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that you perform access control checks related to your business logic. These checks may be different than the access control checks that you apply to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor.

Source: MITRE CWE corpus.