CVE-2026-12770: LiteLLM auth bypass — HIGH

CISO Take

BerriAI LiteLLM versions up to 1.63.1 contain an improper authorization flaw in the Admin Key Handler — the component that creates, modifies, and deletes API keys across the LiteLLM proxy, which many organizations use as a unified gateway routing traffic to OpenAI, Anthropic, and other LLM providers. An authenticated attacker with only low-privilege credentials can exploit this remotely with low complexity, potentially manipulating API key configurations beyond their authorized scope — a control-plane compromise in the heart of your LLM infrastructure. While CVSS scores this medium (5.4) and CISA has not added it to KEV, a public exploit has already been disclosed via GitHub Gist (YLChen-007), materially lowering the bar for exploitation in any shared or multi-tenant LiteLLM deployment. Patch immediately to a version incorporating PR #23781, or as an interim control restrict the Admin Key Handler endpoints to trusted admin IPs using your reverse proxy or firewall.

Sources: NVD ATLAS GitHub Advisory

What is the risk?

Medium CVSS but operationally significant above raw score. The target is LiteLLM's key management control plane — compromising it grants unauthorized authority over which principals can access which LLM providers and at what spend limits. Low privilege requirement (PR:L) means any authenticated user in a shared deployment is a potential attacker; low complexity (AC:L) means no specialized tooling is needed. The CVSS C:N reflects that key material itself is not exfiltrated, but an attacker can create new keys with elevated scopes, destroy existing keys to disrupt operations, or pivot to cost harvesting via unauthorized API usage. Public exploit availability removes the time buffer organizations typically have before threat actors operationalize a finding.

How does the attack unfold?

Initial Access

Attacker authenticates to the LiteLLM proxy using valid low-privilege credentials obtained through any means (credential reuse, insider access, phishing).

AML.T0012

Authorization Bypass

Attacker sends a crafted request to an Admin Key Handler endpoint in key_management_endpoints.py; the missing authorization check processes the request as if the caller held admin privileges.

AML.T0049

Key Provisioning

Attacker creates one or more API keys with elevated scopes or modifies/deletes existing keys, gaining unauthorized control over the LLM gateway's access model.

AML.T0040

Impact

Attacker uses provisioned high-privilege keys to make uncapped LLM inference calls to upstream providers (OpenAI, Anthropic, etc.), causing financial harm via API cost overruns or disrupting legitimate user access by revoking their keys.

AML.T0034

Initial Access

Attacker authenticates to the LiteLLM proxy using valid low-privilege credentials obtained through any means (credential reuse, insider access, phishing).

AML.T0012

Authorization Bypass

Attacker sends a crafted request to an Admin Key Handler endpoint in key_management_endpoints.py; the missing authorization check processes the request as if the caller held admin privileges.

AML.T0049

Key Provisioning

Attacker creates one or more API keys with elevated scopes or modifies/deletes existing keys, gaining unauthorized control over the LLM gateway's access model.

AML.T0040

Impact

Attacker uses provisioned high-privilege keys to make uncapped LLM inference calls to upstream providers (OpenAI, Anthropic, etc.), causing financial harm via API cost overruns or disrupting legitimate user access by revoking their keys.

AML.T0034

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LiteLLM	pip	—	No patch
55.3K OpenSSF 5.8 6 dependents Pushed 6d ago 49% patched ~47d to patch Full package profile →

Do you use LiteLLM? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

4 steps

Patch: Update litellm beyond 1.63.1 — apply the fix from PR #23781 (https://github.com/BerriAI/litellm/pull/23781). Monitor BerriAI GitHub releases for the tagged version incorporating this patch.
Network control: As an immediate workaround, restrict access to Admin Key Handler routes (/key/generate, /key/update, /key/delete, /key/info) to trusted admin IP ranges using your reverse proxy (nginx/Caddy) or host-based firewall.
Detection: Audit LiteLLM access logs for key management API calls originating from non-admin principals or unexpected source IPs. Query the litellm database for recently created keys and validate they were issued by authorized admins.
Access hygiene: Enforce strict separation between admin credentials and general user/service account credentials for the LiteLLM proxy; rotate all existing API keys post-patch to invalidate any keys created via this vulnerability.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass DoS Inference API AML.T0012 - Valid Accounts AML.T0034 - Cost Harvesting AML.T0040 - AI Model Inference API Access AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.6.2 - Roles and responsibilities for AI system lifecycle

NIST AI RMF

GOVERN 1.2 - Risk tolerance and accountability structures

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-12770?

BerriAI LiteLLM versions up to 1.63.1 contain an improper authorization flaw in the Admin Key Handler — the component that creates, modifies, and deletes API keys across the LiteLLM proxy, which many organizations use as a unified gateway routing traffic to OpenAI, Anthropic, and other LLM providers. An authenticated attacker with only low-privilege credentials can exploit this remotely with low complexity, potentially manipulating API key configurations beyond their authorized scope — a control-plane compromise in the heart of your LLM infrastructure. While CVSS scores this medium (5.4) and CISA has not added it to KEV, a public exploit has already been disclosed via GitHub Gist (YLChen-007), materially lowering the bar for exploitation in any shared or multi-tenant LiteLLM deployment. Patch immediately to a version incorporating PR #23781, or as an interim control restrict the Admin Key Handler endpoints to trusted admin IPs using your reverse proxy or firewall.

Is CVE-2026-12770 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-12770, increasing the risk of exploitation.

How to fix CVE-2026-12770?

1. Patch: Update litellm beyond 1.63.1 — apply the fix from PR #23781 (https://github.com/BerriAI/litellm/pull/23781). Monitor BerriAI GitHub releases for the tagged version incorporating this patch. 2. Network control: As an immediate workaround, restrict access to Admin Key Handler routes (/key/generate, /key/update, /key/delete, /key/info) to trusted admin IP ranges using your reverse proxy (nginx/Caddy) or host-based firewall. 3. Detection: Audit LiteLLM access logs for key management API calls originating from non-admin principals or unexpected source IPs. Query the litellm database for recently created keys and validate they were issued by authorized admins. 4. Access hygiene: Enforce strict separation between admin credentials and general user/service account credentials for the LiteLLM proxy; rotate all existing API keys post-patch to invalidate any keys created via this vulnerability.

What systems are affected by CVE-2026-12770?

This vulnerability affects the following AI/ML architecture patterns: LLM API proxy and gateway deployments, multi-tenant LLM inference platforms, enterprise LLM cost management layers, shared LiteLLM instances with multiple user tiers.

What is the CVSS score for CVE-2026-12770?

CVE-2026-12770 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.34%.

What is the AI security impact?

Affected AI Architectures

LLM API proxy and gateway deploymentsmulti-tenant LLM inference platformsenterprise LLM cost management layersshared LiteLLM instances with multiple user tiers

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0034 Cost Harvesting

AML.T0040 AI Model Inference API Access

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.2

NIST AI RMF: GOVERN 1.2

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

A vulnerability was determined in BerriAI litellm up to 1.63.1. The impacted element is an unknown function of the file litellm/proxy/management_endpoints/key_management_endpoints.py of the component Admin Key Handler. This manipulation causes improper authorization. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 23781. It is recommended to apply a patch to fix this issue. The vendor was contacted early about this disclosure.

Exploitation Scenario

An attacker with developer-tier access to a shared enterprise LiteLLM deployment — for example, a contractor account with read-only or limited scopes — sends a crafted HTTP request directly to an Admin Key Handler endpoint such as POST /key/generate. The authorization check in key_management_endpoints.py fails to properly validate that the caller holds admin privileges, so the server processes the request and returns a newly minted API key with elevated permissions. The attacker uses this key to bypass organizational spend controls, making high-volume requests to expensive frontier models (e.g., GPT-4o, Claude Opus) outside their assigned budget, or deletes legitimate team API keys to cause service disruption for other users. Because LiteLLM acts as a gateway multiplexing multiple providers, a single key with admin scope can unlock access to all configured upstream providers simultaneously.

Weaknesses (CWE)

CWE-266 Incorrect Privilege Assignment Primary CWE-285 Improper Authorization Primary CWE-266 Incorrect Privilege Assignment CWE-285 Improper Authorization

CWE-266 — Incorrect Privilege Assignment: A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design, Operation] Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.

Source: MITRE CWE corpus.