CVE-2026-47101highCWE-639CWE-863

CVE-2026-47101: high-severity vulnerability in BerriAI litellm

LiteLLM < 1.83.14 Privilege Escalation via API Key Generation

Published · Updated

Follow this CVE+ Monitor litellm+ Monitor litellm

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 8.7epss 1.2%
from disclosure to weapon4 days
Published on NVDMay 21
1st PoC+4d
LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit. When generating a key, the allowed_routes field is stored without verifying that the specified routes fall within the user's own permissions. A key created with access to admin-only routes can then be used to reach those routes successfully, bypassing the role-based access controls that would otherwise block the request, enabling full privilege escalation from internal_user to proxy_admin.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
BerriAI · litellm
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — BerriAI litellm

In the same product, most dangerous first.

CVE-2026-42271HIGHLiteLLM: Authenticated command execution via MCP stdio test endpointsEPSS 91.4%KEVCVE-2026-42208CRITICALLiteLLM: SQL injection in Proxy API key verificationEPSS 89.4%KEVCVE-2026-59822HIGHLiteLLM: MCP Authentication Bypass via OAuth2 Passthrough FallbackEPSS 0.8%KEVCVE-2026-35029HIGHLiteLLM affected by privilege escalation via unrestricted proxy configuration endpointEPSS 38.6%CVE-2026-49468CRITICALLiteLLM: Authentication Bypass via Host Header InjectionEPSS 3.0%CVE-2026-12773MEDIUMBerriAI litellm MCP Proxy user_api_key_auth_mcp.py UserAPIKeyAuth improper authenticationEPSS 1.0%