AI Security Incident

LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit. When generating a key, the allowed_routes field is stored without verifying that the specified routes fall within the user's own permissions. A key created with access to admin-only routes can then be used to reach those routes successfully, bypassing the role-based access controls that would otherwise block the request, enabling full privilege escalation from internal_user to proxy_admin.

What Happened

LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit. When generating a key, the allowed_routes field is stored without verifying that the specified routes fall within the user's own permissions. A key created with access to admin-only routes can then be used to reach those routes successfully, bypassing the role-based access controls that would otherwise block the request, enabling full privilege escalation from internal_user to proxy_admin.

Why This Matters

The evidence matters to defenders using the affected technology because it could allow an attacker to gain additional privileges.

Recommended Action

No confirmed vendor remediation is available in the current evidence. Identify deployments of the affected technology matching the evidenced affected versions: 1.83.14.

Exposure

Exposure reason: This incident does not currently match a technology in My Interests.

Exploitation status: UNKNOWN

Affected versions: 1.83.14

Primary entities:

Timeline

• Incident first seen
  May 22, 2026 03:00

  BugSkan first recorded this incident.

• LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit
  May 22, 2026 03:00

  GitHub Advisory Database · Research

Sources

Related Incidents

Other BugSkan incidents that share identifiers, products, or vendors with this report.

My Interests Match