BerriAI vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited BerriAI flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2026-59822 BerriAI LiteLLM Improper AuthenticationExploited since Sep 2, 2026 · CVSS 8.8
• CVE-2026-42271 BerriAI LiteLLM Command InjectionExploited since Jun 8, 2026 · CVSS 8.7
• CVE-2026-42208 BerriAI LiteLLM SQL InjectionExploited since May 8, 2026 · CVSS 9.3

Latest high and critical flaws

• CVE-2026-114612 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format.Critical 9.9 · Oct 22, 2026
• CVE-2026-93355 LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any exHigh 7.6 · Sep 28, 2026
• CVE-2026-89032 BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other tHigh 8.7 · Sep 25, 2026
• CVE-2026-59822 BerriAI LiteLLM Improper AuthenticationExploited · High 8.8 · Jul 8, 2026
• CVE-2026-49468 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format.Critical 9.5 · Jun 22, 2026
• CVE-2026-47102 LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint.High 8.7 · May 21, 2026
• CVE-2026-47101 LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit.High 8.7 · May 21, 2026
• CVE-2026-42271 BerriAI LiteLLM Command InjectionExploited · High 8.7 · May 8, 2026
• CVE-2026-42208 BerriAI LiteLLM SQL InjectionExploited · Critical 9.3 · May 8, 2026
• CVE-2026-42203 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format.High 8.6 · May 8, 2026
• CVE-2026-40217 LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.High 8.8 · Apr 10, 2026
• CVE-2026-35030 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format.Critical 9.4 · Apr 6, 2026
• CVE-2026-35029 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format.High 8.7 · Apr 6, 2026
• CVE-2025-0628 An improper authorization vulnerability exists in the main-latest version of BerriAI/litellm.High 8.1 · Mar 20, 2025
• CVE-2025-0330 In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error occurs while parsing team settings.High 7.5 · Mar 20, 2025
• CVE-2024-9606 In berriai/litellm before version 1.44.12, the `litellm/litellm_core_utils/litellm_logging.py` file contains a vulnerability where the API key masking code onlyHigh 7.5 · Mar 20, 2025
• CVE-2024-8984 A Denial of Service (DoS) vulnerability exists in berriai/litellm version v1.44.5.High 7.5 · Mar 20, 2025
• CVE-2024-6825 BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution.High 8.8 · Mar 20, 2025
• CVE-2024-10188 A vulnerability in BerriAI/litellm, as of commit 26c03c9, allows unauthenticated users to cause a Denial of Service (DoS) by exploiting the use of ast.literal_eHigh 7.5 · Mar 20, 2025
• CVE-2024-6587 A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10.High 7.5 · Sep 13, 2024
• CVE-2024-42679 SQL Injection vulnerability in Super easy enterprise management system v.1.0.0 and before allows a local attacker to execute arbitrary code via a crafted scriptHigh 7.8 · Aug 15, 2024
• CVE-2024-5751 BerriAI/litellm version v1.35.8 contains a vulnerability where an attacker can achieve remote code execution.Critical 9.8 · Jun 27, 2024
• CVE-2024-5225 An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the `/global/spend/logs` endpoint.High 7.2 · Jun 6, 2024
• CVE-2024-4888 BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on the `/audio/transcriptions` endpoint.High 8.1 · Jun 6, 2024
• CVE-2024-4889 A code injection vulnerability exists in the berriai/litellm application, version 1.34.6, due to the use of unvalidated input in the eval function within the seHigh 7.2 · Jun 6, 2024