CVE-2026-12771: LiteLLM JWT auth bypass

CISO Take

A publicly disclosed improper authorization flaw in litellm's Machine-to-Machine JWT handler (CVE-2026-12771) allows a low-privileged remote attacker to bypass access controls in the proxy authentication layer of versions up to 1.82.2. litellm is widely deployed as the AI gateway layer that aggregates and routes requests to multiple LLM providers — OpenAI, Anthropic, Azure OpenAI, Bedrock — meaning a successful bypass could expose all downstream API keys stored in the proxy and enable unauthorized model access across your entire AI stack. Though CVSS scores medium (5.0) and the attack complexity is rated high, a public proof-of-concept exploit is already available on GitHub (gist by YLChen-007), materially lowering the bar for exploitation by opportunistic attackers. Upgrade immediately beyond 1.82.2, restrict network exposure of the litellm proxy endpoint, and rotate all downstream LLM provider API keys if the proxy was Internet-accessible.

Sources: NVD ATLAS GitHub (public PoC gist YLChen-007) VulnDB

What is the risk?

Medium CVSS (5.0) understates the organizational risk for AI-heavy environments. litellm serves as a centralized trust boundary aggregating API keys and routing inference traffic to multiple LLM providers; compromise of its M2M JWT authorization layer collapses that boundary. Attack complexity is high (credential or token precondition required), and there is no confirmed active exploitation or CISA KEV listing, but the public PoC lowers the effective exploitation bar. Organizations exposing litellm proxy endpoints on internal networks with M2M integrations should treat this as elevated-medium priority.

How does the attack unfold?

Initial Access

Attacker with low-privileged network access identifies a litellm proxy instance and targets its M2M JWT authentication endpoint.

AML.T0049

Authorization Bypass

Attacker presents a crafted or manipulated M2M JWT token that exploits the improper privilege assignment flaw in user_api_key_auth.py, bypassing expected access controls.

AML.T0091.000

API Access

With proxy-level access granted, attacker routes unauthorized inference requests to all downstream LLM providers configured in the litellm proxy.

AML.T0040

Impact

Attacker exfiltrates downstream API keys, runs unauthorized model queries for data extraction or cost harvesting, or uses the proxy as a pivot into connected AI agent tooling.

AML.T0034

Initial Access

Attacker with low-privileged network access identifies a litellm proxy instance and targets its M2M JWT authentication endpoint.

AML.T0049

Authorization Bypass

Attacker presents a crafted or manipulated M2M JWT token that exploits the improper privilege assignment flaw in user_api_key_auth.py, bypassing expected access controls.

AML.T0091.000

API Access

With proxy-level access granted, attacker routes unauthorized inference requests to all downstream LLM providers configured in the litellm proxy.

AML.T0040

Impact

Attacker exfiltrates downstream API keys, runs unauthorized model queries for data extraction or cost harvesting, or uses the proxy as a pivot into connected AI agent tooling.

AML.T0034

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LiteLLM	pip	—	No patch
55.3K OpenSSF 5.8 6 dependents Pushed 6d ago 49% patched ~47d to patch Full package profile →

Do you use LiteLLM? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 21% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC High

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

6 steps

Upgrade litellm to a version beyond 1.82.2 — monitor the BerriAI GitHub for a patched release and apply immediately.
If patching is not immediately possible, restrict network access to the litellm proxy using firewall rules, VPN enforcement, or IP allowlisting to reduce the attack surface.
Rotate all downstream LLM provider API keys (OpenAI, Anthropic, Azure, etc.) stored in litellm configuration if the proxy was network-accessible during the vulnerability window.
Temporarily disable M2M JWT authentication in favor of API key-based auth if your deployment supports it.
Audit authentication logs in user_api_key_auth.py call paths for anomalous JWT token presentations, unexpected privilege escalations, or unauthorized model invocations.
Scan your deployment using the referenced PoC gist pattern to confirm exploitability in your specific configuration.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Inference API AML.T0012 - Valid Accounts AML.T0034 - Cost Harvesting AML.T0040 - AI Model Inference API Access AML.T0049 - Exploit Public-Facing Application AML.T0091.000 - Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15(3) - Cybersecurity measures for AI systems

ISO 42001

A.6.2 - AI system security

NIST AI RMF

MANAGE 2.2 - Mechanisms to neutralize AI risk

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-12771?

A publicly disclosed improper authorization flaw in litellm's Machine-to-Machine JWT handler (CVE-2026-12771) allows a low-privileged remote attacker to bypass access controls in the proxy authentication layer of versions up to 1.82.2. litellm is widely deployed as the AI gateway layer that aggregates and routes requests to multiple LLM providers — OpenAI, Anthropic, Azure OpenAI, Bedrock — meaning a successful bypass could expose all downstream API keys stored in the proxy and enable unauthorized model access across your entire AI stack. Though CVSS scores medium (5.0) and the attack complexity is rated high, a public proof-of-concept exploit is already available on GitHub (gist by YLChen-007), materially lowering the bar for exploitation by opportunistic attackers. Upgrade immediately beyond 1.82.2, restrict network exposure of the litellm proxy endpoint, and rotate all downstream LLM provider API keys if the proxy was Internet-accessible.

Is CVE-2026-12771 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-12771, increasing the risk of exploitation.

How to fix CVE-2026-12771?

1. Upgrade litellm to a version beyond 1.82.2 — monitor the BerriAI GitHub for a patched release and apply immediately. 2. If patching is not immediately possible, restrict network access to the litellm proxy using firewall rules, VPN enforcement, or IP allowlisting to reduce the attack surface. 3. Rotate all downstream LLM provider API keys (OpenAI, Anthropic, Azure, etc.) stored in litellm configuration if the proxy was network-accessible during the vulnerability window. 4. Temporarily disable M2M JWT authentication in favor of API key-based auth if your deployment supports it. 5. Audit authentication logs in user_api_key_auth.py call paths for anomalous JWT token presentations, unexpected privilege escalations, or unauthorized model invocations. 6. Scan your deployment using the referenced PoC gist pattern to confirm exploitability in your specific configuration.

What systems are affected by CVE-2026-12771?

This vulnerability affects the following AI/ML architecture patterns: LLM proxy and gateway deployments, Multi-model inference pipelines, Agent frameworks using litellm as inference backend, Server-to-server M2M AI integrations.

What is the CVSS score for CVE-2026-12771?

CVE-2026-12771 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

LLM proxy and gateway deploymentsMulti-model inference pipelinesAgent frameworks using litellm as inference backendServer-to-server M2M AI integrations

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0034 Cost Harvesting

AML.T0040 AI Model Inference API Access

AML.T0049 Exploit Public-Facing Application

AML.T0091.000 Application Access Token

Compliance Controls Affected

EU AI Act: Art. 15(3)

ISO 42001: A.6.2

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/user_api_key_auth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

Exploitation Scenario

An attacker with low-privileged internal network access — a compromised service account, a rogue insider, or a pivoting threat actor — identifies a litellm proxy instance via internal network scanning. They craft a specially manipulated M2M JWT token that exploits the improper privilege assignment flaw (CWE-266/CWE-285) in user_api_key_auth.py, bypassing the expected authorization checks to obtain elevated proxy access. With proxy-level access, the attacker enumerates available model routes, exfiltrates stored provider API keys, and begins issuing unauthorized LLM inference requests — either for data exfiltration via the LLM context, cost harvesting by running resource-intensive queries, or as a pivot point to abuse AI agent tooling connected to the proxy.

Weaknesses (CWE)

CWE-266 Incorrect Privilege Assignment Primary CWE-285 Improper Authorization Primary CWE-266 Incorrect Privilege Assignment CWE-285 Improper Authorization

CWE-266 — Incorrect Privilege Assignment: A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design, Operation] Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.

Source: MITRE CWE corpus.