LiteLLM fixes flaw that could expose proxy master keys

BerriAI has fixed a critical vulnerability in LiteLLM Enterprise Proxy that earned a CVSS v3.1 score of 10.0. The issue, tracked as GHSA-w4c7-34wj-hqm8, allows an unauthenticated attacker to read a local file via any LLM route and exfiltrate its contents to a attacker-controlled URL.

The advisory states that the leaked file can reveal the proxy’s master key (LITELLM_MASTER_KEY) and stored provider API keys, effectively giving an attacker full admin access to the proxy in many configurations and potentially enabling arbitrary code execution as root. The flaw affects LiteLLM proxies operating with an Enterprise licence; open source deployments without a licence are noted as not affected.

Patched releases were published on PyPI on 27 October 2026, with fixed versions 1.103.10, 1.104.8, 1.105.6 and 1.106.5 corresponding to each release line.

The vulnerability was reported by Dylan Ong of Karmasec and Cyrill Bannwart of Compass Security. At present, no CVE ID had been assigned publicly, and there has been no public exploitation proof-of-concept confirmed by the researchers or vendor. The attack requires sending a request to any LiteLLM route; the advisory explains that this could prompt the proxy to read a local file and send its contents to a URL chosen by the attacker, with the environment file potentially exposing keys.

The report emphasises the severity of access to master keys and provider credentials, since LiteLLM functions as a gateway between applications and AI providers.

Patch and mitigation guidance from the advisory includes updating to the fixed release for your branch, blocking callback-related JSON keys at a WAF or reverse proxy if an update is not yet possible, and restricting outbound traffic to known LLM provider endpoints to halt the data theft step. It also urges keeping the proxy off the public internet and rotating the master key and provider keys if exposure occurred.