Breaking

LiteLLM Flaw Chain Lets Low-Privilege Users Seize Admin Control

June 17, 2026 at 10:05 EDT

Security
AI Agents
Open Source

LiteLLM, the open-source AI gateway, has been found to contain a vulnerability chain that lets a low-privilege user seize administrator rights and run arbitrary code on the server. Discovered by Obsidian Security, the issue was detailed by The Hacker News on June 15, 2026. Rated up to CVSS 9.9, it affects versions prior to v1.83.14-stable.

CVSS 9.9 · LiteLLM AI Gateway

Three-Flaw Chain Turns a Low-Privilege LiteLLM Account Into Full Server RCE

A vulnerability chain in the popular open-source AI gateway lets a default internal_user escalate to admin and run arbitrary code. Fixes ship in v1.83.14-stable and later — but patching alone won't undo the exposure.

9.9

CVSS severity — critical

Chained CVEs from low-priv to RCE

100+

LLM providers brokered through the gateway

The escalation chain

CVE-2026-47101

Authorization bypass

Wildcard grant via unvalidated allowed_routes

→

CVE-2026-47102

Privilege escalation

Role self-elevation via /user/update

→

CVE-2026-40217

Sandbox escape → RCE

Custom Code Guardrail via exec()

Why one breach hurts so much

Deployed as a proxy, LiteLLM is a single point of failure — it holds every secret that passes through it.

Master key Decryption salt key DB URL All provider API keys Prompts & responses MCP / OAuth tokens

Speed of exploitation — a precedent

This chain is not yet exploited in the wild, but a past LiteLLM SQL injection was abused fast after disclosure.

~40 min

PyPI backdoor live window (Mar 24)

36 hrs

Prior SQLi abused after disclosure

Reportedly unaffected

Official Docker images (pinned deps)
Cloud version
Version-pinned deployments

Required actions

Upgrade to v1.83.14-stable+
Rotate all secrets
Audit callbacks in config.yaml
Verify Docker image signatures

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.