LiteLLM is the easiest way to put one API in front of every model provider. That ease is why it ends up holding a company’s provider keys, virtual keys and model config. A component in that position gets a vendor security review. This page is the public record that review would start from.
Easy to use doesn’t forgive gaping security flaws.
Summary
- Two supply chain compromises of published releases: March 2026 (1.82.7, 1.82.8) and October 21, 2026 (1.107.0 wheels and Docker image). (JFrog )
- Three CVEs in the CISA Known Exploited Vulnerabilities catalog: CVE-2026-42208, CVE-2026-42271, CVE-2026-59822.
- Exploitation of CVE-2026-42208 observed about 36 hours after the advisory was indexed, aimed at the tables holding virtual keys and provider credentials. (Sysdig )
- Repeat bug classes: template injection to code execution (2024, 2026), auth bypass (four CVEs in 2026), code execution through config endpoints (2024, 2025).
Timeline
| Date (first public record) | Entry | Class | CVSS | KEV | Source |
|---|---|---|---|---|---|
| 2024-04-10 | CVE-2024-2952 | Template injection (SSTI) to RCE, /completions | 9.8 | No | NVD |
| 2024-06-27 | CVE-2024-5751 | RCE via /config/update | 9.8 | No | NVD |
| 2025-03-20 | CVE-2024-6825 | RCE via post_call_rules | 8.8 | No | NVD |
| March 2026 | Supply chain compromise #1: 1.82.7, 1.82.8 backdoored on PyPI after a malicious Trivy release in CI exposed publishing credentials | Supply chain | n/a | n/a | JFrog |
| 2026-04-03 | CVE-2026-35030 | Auth bypass, OIDC cache key (only with enable_jwt_auth, off by default) | 9.4 (CNA) | No | GHSA |
| 2026-04-20 | CVE-2026-42208 | Pre-auth SQL injection in API key verification | 9.8 | Added 2026-05-08 | GHSA |
| 2026-04-26 | CVE-2026-42208 exploitation observed, ~36h after GHSA indexing, targeting key and credential tables | Exploitation | n/a | n/a | Sysdig |
| 2026-05-08 | CVE-2026-42271 | Command injection via MCP stdio test endpoints | 8.8 | Added 2026-06-08 | NVD |
| 2026-05-21 | CVE-2026-47101 | Privilege escalation: internal_user mints keys for admin routes | 8.8 | No | NVD |
| 2026-06-16 | CVE-2026-49468 | Auth bypass via Host header, management routes | 9.8 (NVD) | No | GHSA |
| 2026-06-21 | CVE-2026-12773 | Auth bypass, MCP proxy | 9.8 NVD / 7.3 CNA | No | NVD |
| 2026-07-08 | CVE-2026-59822 | Auth bypass, MCP OAuth2 passthrough fallback | 8.2 NVD / 8.8 CNA | Added 2026-09-02 | NVD |
| 2026-08-27 | CVE-2026-37004 | Unauthenticated SSTI to OS command exec, /prompts/test | 9.8 | No | NVD |
| 2026-10-21 | Supply chain compromise #2: all seven 1.107.0 wheels and the Docker image carried a credential stealer and hourly remote code loader; sdist did not contain the payload | Supply chain | n/a | n/a | JFrog |
KEV status from the CISA KEV catalog , checked Oct 22, 2026.
Dates are first public record (GitHub advisory where earlier than NVD). Where NVD and the reporting CNA disagree on CVSS, both are shown. This table lists only entries confirmed against primary sources; counts of additional CVEs published in the same batches are left out because they could not be verified.
What an enterprise security review would note
- The release pipeline was compromised twice in seven months, through different paths.
- In the October incident the source distribution did not contain the payload. Reviewing source or a Git tag would not have caught it.
- Vulnerabilities sit in the authentication path itself: the API key check, JWT handling, Host header routing, MCP auth fallbacks.
- Three findings were exploited in the wild, per CISA.
Questions your security team should ask before deploying it
- Which exact artifact do we run, and do we verify the wheel or image digest we deploy, not just the source tag?
- Do we pin versions and block mutable tags like
latestandmain-stable? - Where do provider keys live? If the gateway host is compromised, how many upstream accounts go with it?
- Is the admin and management surface reachable from anything but a private network?
- Are MCP and prompt test endpoints enabled, and who can reach them?
- How fast can we patch a KEV-listed gateway bug, given exploitation started 36 hours after disclosure last time?
- If we installed 1.82.7, 1.82.8 or 1.107.0 anywhere, have we rotated every credential that host could reach?
- What does the vendor’s release process look like now, and what changed after each incident?
Sources
- JFrog Security Research, “LiteLLM Hijacked Again”, Oct 21, 2026: https://research.jfrog.com/post/litellm-hijacked-again/
- Sysdig TRT on CVE-2026-42208: https://www.sysdig.com/blog/cve-2026-42208-targeted-sql-injection-against-litellms-authentication-path-discovered-36-hours-following-vulnerability-disclosure
- CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- NVD and GitHub Advisory Database entries linked in the table.