CVE-2026-49468: LiteLLM auth bypass

Q: Is CVE-2026-49468 actively exploited?

No confirmed active exploitation of CVE-2026-49468 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-49468?

1. Upgrade litellm to >= 1.84.0 — no configuration change required post-upgrade. 2. If unable to patch immediately, place the proxy behind a CDN (Cloudflare), WAF, or reverse proxy (nginx, Caddy) with explicit server_name allowlists to validate and normalize Host headers before forwarding. 3. Restrict network access to the proxy listener to trusted internal CIDR ranges via firewall rules as an additional control. 4. Detection: audit proxy access logs for requests with Host headers that do not match the canonical proxy hostname (unexpected domains, IP literals, port variants, internal hostnames). 5. Rotate all LLM API keys and virtual keys accessible via management routes if exposure cannot be ruled out for the affected version window.

CISO Take

A Host-header parsing flaw in LiteLLM's proxy auth layer (litellm < 1.84.0) lets an unauthenticated attacker reach protected management routes by crafting a Host header that makes the auth gate evaluate a different path than FastAPI actually dispatches, exploiting CWE-290 (Authentication Bypass by Spoofing). LiteLLM is the de facto multi-provider LLM gateway in many enterprise AI stacks — a successful bypass exposes management APIs that hold upstream LLM API keys (OpenAI, Anthropic, etc.), model routing rules, and spending controls, making the blast radius significant beyond the 6 tracked downstream dependents. EPSS places this in the top 80th percentile for exploitation likelihood and the technique requires no AI/ML knowledge whatsoever, just standard HTTP header manipulation. Upgrade to litellm 1.84.0 immediately; if patching is blocked, place the proxy behind a CDN, WAF, or reverse proxy with explicit server_name allowlists — and rotate any LLM API keys accessible via management routes as a precaution.

Sources: NVD EPSS GitHub Advisory ATLAS OpenSSF

What is the risk?

HIGH risk for self-hosted LiteLLM proxy deployments exposed without an upstream host-validating layer. The vulnerability is trivially exploitable — no specialized knowledge required beyond basic HTTP tooling. Successful exploitation of management routes (/key, /user, /model, /spend) can expose LLM API keys, enable unauthorized model routing to attacker-controlled endpoints, create privileged access tokens, and remove rate-limiting or spending controls enabling cost harvesting. Cloud-hosted LiteLLM and deployments behind Cloudflare, nginx with server_name allowlists, or cloud load balancers are explicitly not affected, limiting exposure to bare-metal or container deployments with direct network access.

How does the attack unfold?

Initial Access

Attacker identifies an internet-exposed LiteLLM proxy without an upstream CDN or WAF and sends HTTP requests with crafted Host headers to probe the auth boundary.

AML.T0049

Auth Gate Evasion

The malformed Host header causes get_request_route() in auth_utils.py to resolve an unprotected or whitelisted route, skipping authentication while FastAPI dispatches the request to the real protected management endpoint.

AML.T0107

Credential Exfiltration

Attacker iterates unauthenticated management endpoints (/key/list, /model/info, /user/info) to enumerate and extract upstream LLM provider API keys and virtual keys from the proxy database.

AML.T0055

Impact

Stolen API keys enable unauthorized LLM inference at the victim's expense, manipulation of model routing to attacker-controlled endpoints, or escalated compromise of upstream LLM provider accounts.

AML.T0034

Initial Access

Attacker identifies an internet-exposed LiteLLM proxy without an upstream CDN or WAF and sends HTTP requests with crafted Host headers to probe the auth boundary.

AML.T0049

Auth Gate Evasion

The malformed Host header causes get_request_route() in auth_utils.py to resolve an unprotected or whitelisted route, skipping authentication while FastAPI dispatches the request to the real protected management endpoint.

AML.T0107

Credential Exfiltration

Attacker iterates unauthenticated management endpoints (/key/list, /model/info, /user/info) to enumerate and extract upstream LLM provider API keys and virtual keys from the proxy database.

AML.T0055

Impact

Stolen API keys enable unauthorized LLM inference at the victim's expense, manipulation of model routing to attacker-controlled endpoints, or escalated compromise of upstream LLM provider accounts.

AML.T0034

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LiteLLM	pip	< 1.84.0	`1.84.0`
55.3K OpenSSF 5.8 6 dependents Pushed 6d ago 49% patched ~47d to patch Full package profile →

Do you use LiteLLM? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 45% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC High

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

5 steps

Upgrade litellm to >= 1.84.0 — no configuration change required post-upgrade.
If unable to patch immediately, place the proxy behind a CDN (Cloudflare), WAF, or reverse proxy (nginx, Caddy) with explicit server_name allowlists to validate and normalize Host headers before forwarding.
Restrict network access to the proxy listener to trusted internal CIDR ranges via firewall rules as an additional control.
Detection: audit proxy access logs for requests with Host headers that do not match the canonical proxy hostname (unexpected domains, IP literals, port variants, internal hostnames).
Rotate all LLM API keys and virtual keys accessible via management routes if exposure cannot be ruled out for the affected version window.

What does CISA's SSVC say?

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Inference API AML.T0034 - Cost Harvesting AML.T0049 - Exploit Public-Facing Application AML.T0055 - Unsecured Credentials AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, robustness and cybersecurity

ISO 42001

6.1.2 - AI risk assessment 9.1 - Monitoring, measurement, analysis and evaluation

NIST AI RMF

MANAGE 2.4 - Residual risks are addressed

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-49468?

A Host-header parsing flaw in LiteLLM's proxy auth layer (litellm < 1.84.0) lets an unauthenticated attacker reach protected management routes by crafting a Host header that makes the auth gate evaluate a different path than FastAPI actually dispatches, exploiting CWE-290 (Authentication Bypass by Spoofing). LiteLLM is the de facto multi-provider LLM gateway in many enterprise AI stacks — a successful bypass exposes management APIs that hold upstream LLM API keys (OpenAI, Anthropic, etc.), model routing rules, and spending controls, making the blast radius significant beyond the 6 tracked downstream dependents. EPSS places this in the top 80th percentile for exploitation likelihood and the technique requires no AI/ML knowledge whatsoever, just standard HTTP header manipulation. Upgrade to litellm 1.84.0 immediately; if patching is blocked, place the proxy behind a CDN, WAF, or reverse proxy with explicit server_name allowlists — and rotate any LLM API keys accessible via management routes as a precaution.

Is CVE-2026-49468 actively exploited?

No confirmed active exploitation of CVE-2026-49468 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-49468?

1. Upgrade litellm to >= 1.84.0 — no configuration change required post-upgrade. 2. If unable to patch immediately, place the proxy behind a CDN (Cloudflare), WAF, or reverse proxy (nginx, Caddy) with explicit server_name allowlists to validate and normalize Host headers before forwarding. 3. Restrict network access to the proxy listener to trusted internal CIDR ranges via firewall rules as an additional control. 4. Detection: audit proxy access logs for requests with Host headers that do not match the canonical proxy hostname (unexpected domains, IP literals, port variants, internal hostnames). 5. Rotate all LLM API keys and virtual keys accessible via management routes if exposure cannot be ruled out for the affected version window.

What systems are affected by CVE-2026-49468?

This vulnerability affects the following AI/ML architecture patterns: LLM API gateways, model serving, agent frameworks, RAG pipelines, multi-provider LLM routing.

What is the CVSS score for CVE-2026-49468?

CVE-2026-49468 has a CVSS v3.1 base score of 8.1 (CRITICAL). The EPSS exploitation probability is 0.59%.

What is the AI security impact?

Affected AI Architectures

LLM API gatewaysmodel servingagent frameworksRAG pipelinesmulti-provider LLM routing

MITRE ATLAS Techniques

AML.T0034 Cost Harvesting

AML.T0049 Exploit Public-Facing Application

AML.T0055 Unsecured Credentials

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: 6.1.2, 9.1

NIST AI RMF: MANAGE 2.4

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, This vulnerability is fixed in 1.84.0.

Exploitation Scenario

An attacker identifies a LiteLLM proxy exposed on a non-standard port without an upstream CDN or reverse proxy. They send an HTTP request with a crafted Host header — e.g., Host: localhost or Host: 127.0.0.1 — designed to make auth_utils.py's get_request_route() resolve the effective path to an internal or unprotected route, bypassing the authentication check. FastAPI simultaneously dispatches the request to the actual protected management endpoint as normal. The attacker iterates against known management paths (/key/list, /user/info, /model/info, /spend/logs) and successfully reads all configured upstream LLM API keys and virtual key credentials. Those keys are then used to run unauthorized inference at the victim's expense or to pivot into the victim's OpenAI/Anthropic accounts for further access.

Weaknesses (CWE)

CWE-290 Authentication Bypass by Spoofing Primary CWE-290 Authentication Bypass by Spoofing Primary CWE-290 Authentication Bypass by Spoofing

CWE-290 — Authentication Bypass by Spoofing: This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Source: MITRE CWE corpus.