Security brief

LiteLLM flaw chain linked low-privilege keys to administration and code execution

REVIEW

The reported chain combined three separate authorization and execution weaknesses, rather than one generic Claude vulnerability.

Published 29 Oct 2026 · Material update 15 Jun 2026 — last time the underlying evidence changed · Evidence: medium

What happened

June 2026 reporting described a LiteLLM chain combining permissive virtual-key routes, unrestricted user-role updates and unsafe custom guardrail execution. Together, the issues could let a low-privilege user reach administrative capabilities and execute code.

The report identifies CVE-2026-47101, CVE-2026-47102 and CVE-2026-40217, and says the complete fix set was included in 1.83.14-stable. Individual fixes and later advisories should still be checked against the deployed branch.

Use a maintained release and investigate unexpected key permissions, role changes and custom guardrails. Provider credentials stored in the gateway may be at risk after a takeover, but provider names in that configuration do not establish breaches of their own infrastructure.

Read the original source.

Next step

Update the gateway and audit key permissions, role changes and custom guardrails.

What remains unknown

Open question
The sources reviewed do not establish whether your deployment was exploited.

Source references

Technical details

CVE
CVE-2026-47101
CVE
CVE-2026-47102
CVE
CVE-2026-40217