CVE-2026-108575: LiteLLM: improper authorization in get_secret api_key

MEDIUMCISA: TRACK*

Published October 11, 2026

CISO Take

LiteLLM up to 1.94.0 has an improper authorization flaw in the secret resolution function get_secret (secret_managers/main.py), where a low-privileged remote user can manipulate the api_key argument to reach secrets they should not be able to read or use. LiteLLM commonly sits as the central gateway holding provider keys for OpenAI, Anthropic and others, so a secret-resolution bypass can expose credentials for every model backend behind it. The exploit details are public and the vendor has not responded to disclosure, but CVSS is only 6.3, there is no KEV listing, no EPSS data, no Nuclei template and no confirmed public exploit code, so mass exploitation is not yet evidenced. The package has 6 tracked dependents, an OpenSSF Scorecard of 6/10 and 46 other CVEs, which signals a recurring pattern of weak authorization in this component. Restrict network access to the LiteLLM proxy, limit who can create or use virtual keys, rotate upstream provider and secret-manager credentials if the proxy is exposed, and monitor for a vendor patch since none is currently available.

Sources:NVDVulDBOpenSSFATLAS

What is the risk?

Medium overall (CVSS 6.3, PR:L, network-reachable, low complexity, no user interaction). Risk is elevated for internet-exposed LiteLLM proxies with multiple tenants or integrated secret managers (AWS Secrets Manager, Vault, etc.), because compromise of resolved secrets enables lateral abuse of upstream LLM accounts. Exploit maturity is proof-of-concept, there is no vendor response or patch, and no active exploitation evidence. Affected version range and fixed version are not specified in the data, so exposure should be assumed for all versions up to 1.94.0.

How does the attack unfold?

Initial Access

Attacker reaches an exposed LiteLLM proxy with a low-privilege account or virtual key.

AML.T0049

Exploitation

Crafted api_key input to get_secret bypasses authorization checks in secret resolution.

AML.T0055

Credential Access

Attacker obtains provider or secret-manager credentials outside their authorization.

AML.T0012

Impact

Stolen credentials are used for unauthorized inference, cost abuse or lateral access to AI services.

AML.T0048.000

Initial Access

Attacker reaches an exposed LiteLLM proxy with a low-privilege account or virtual key.

AML.T0049

Exploitation

Crafted api_key input to get_secret bypasses authorization checks in secret resolution.

AML.T0055

Credential Access

Attacker obtains provider or secret-manager credentials outside their authorization.

AML.T0012

Impact

Stolen credentials are used for unauthorized inference, cost abuse or lateral access to AI services.

AML.T0048.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LiteLLM	pip	—	No patch
62.0KOpenSSF 6.0Pushed 6d ago51% patched~47d to patchFull package profile →

Do you use LiteLLM? You're affected.

How severe is it?

CVSS 3.1

6.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 10% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CLow

ILow

ALow

What should I do?

1 step

1) No patched version is identified; track the BerriAI/litellm repository and VulDB entry 416232 for a fix and upgrade beyond 1.94.0 once released. 2) Do not expose the proxy directly to the internet; place it behind an authenticated reverse proxy, VPN or allowlist. 3) Minimize privileges of issued virtual keys and remove unused low-privilege accounts. 4) Scope secret-manager permissions for the LiteLLM service identity to only the secrets it needs. 5) Rotate upstream provider API keys and secret-manager credentials if suspicious access is found. 6) Monitor proxy logs for unusual api_key values or secret-reference strings in requests, unexpected key usage, and anomalous spend per provider key.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData LeakageInferenceAPIFrameworkAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0055- Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.9.3-Responsible use and security of AI system third-party components

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and manage third-party AI component risk

OWASP LLM Top 10

LLM06-Excessive Agency / Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-108575?

Is CVE-2026-108575 actively exploited?

No confirmed active exploitation of CVE-2026-108575 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-108575?

1) No patched version is identified; track the BerriAI/litellm repository and VulDB entry 416232 for a fix and upgrade beyond 1.94.0 once released. 2) Do not expose the proxy directly to the internet; place it behind an authenticated reverse proxy, VPN or allowlist. 3) Minimize privileges of issued virtual keys and remove unused low-privilege accounts. 4) Scope secret-manager permissions for the LiteLLM service identity to only the secrets it needs. 5) Rotate upstream provider API keys and secret-manager credentials if suspicious access is found. 6) Monitor proxy logs for unusual api_key values or secret-reference strings in requests, unexpected key usage, and anomalous spend per provider key.

What systems are affected by CVE-2026-108575?

This vulnerability affects the following AI/ML architecture patterns: LLM gateways and proxies, model serving, agent frameworks, multi-tenant LLM platforms.

What is the CVSS score for CVE-2026-108575?

CVE-2026-108575 has a CVSS v3.1 base score of 6.3 (MEDIUM). The EPSS exploitation probability is 0.20%.

What is the AI security impact?

Affected AI Architectures

LLM gateways and proxiesmodel servingagent frameworksmulti-tenant LLM platforms

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0055Unsecured Credentials

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.9.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

A vulnerability has been found in BerriAI LiteLLM up to 1.94.0. This affects the function get_secret of the file secret_managers/main.py of the component Secret Resolution. The manipulation of the argument api_key leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Exploitation Scenario

An attacker obtains or registers a low-privilege account or virtual key on an exposed LiteLLM proxy. They send requests with a crafted api_key value that is passed to get_secret, causing the proxy to resolve a secret reference without proper authorization checks. The attacker then uses the resolved provider credentials or another tenant's key to run inference at the victim's expense, access restricted models, or pivot to other systems that share those secrets.

Weaknesses (CWE)

CWE-266Incorrect Privilege AssignmentPrimary CWE-285Improper AuthorizationPrimary CWE-266Incorrect Privilege Assignment CWE-285Improper Authorization

CWE-266 — Incorrect Privilege Assignment: A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design, Operation] Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.

Source: MITRE CWE corpus.