CVE-2026-47101
8.8 HIGHLiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit
Published: 2026-05-21 · Last updated: 2026-06-11
Severity and scoring
- CVSS
- 8.8 HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-863
Affected products
| Vendor | Product |
|---|---|
| litellm | litellm |
Description
LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit. When generating a key, the allowed_routes field is stored without verifying that the specified routes fall within the user's own permissions. A key created with access to admin-only routes can then be used to reach those routes successfully, bypassing the role-based access controls that would otherwise block the request, enabling full privilege escalation from internal_user to proxy_admin.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-47101
- [Exploit reference]https://gist.github.com/13ph03nix/9ec616e1fdc77b3673509c60206e827f
- [Patch]https://github.com/BerriAI/litellm/commit/2220f3076ac89bd2a2e3439acf57dcfbec2434c9
- [Patch]https://github.com/BerriAI/litellm/commit/5190bd07eb23a037745d86328096f54378f1614a
- [Patch]https://github.com/BerriAI/litellm/commit/d910a95661fce3cdd36f3b06c03ecf9c46c6457c
- [Other]https://github.com/BerriAI/litellm/releases/tag/v1.83.14-stable
- [Exploit reference]https://huntr.com/bounties/8e75edfb-ff05-4e63-bfca-2d93d03fb3b9
- [Other]https://www.obsidiansecurity.com/blog/litellm-privilege-escalation-rce
- [Other]https://www.vulncheck.com/advisories/litellm-privilege-escalation-via-api-key-generation
Related CVEs
Same vendor
- CVE-2026-47102 — LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint (8.8 HIGH)
- CVE-2026-42271 — LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format (8.8 HIGH)
Same CWE
- CVE-2026-53860 — OpenClaw before 2026.5.7 contains a sender policy bypass vulnerability in BlueBubbles that allows participants to match allowlist entries... (4.2 MEDIUM)
- CVE-2026-53855 — OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken strict allowlist checks ... (8.1 HIGH)
- CVE-2026-53854 — OpenClaw before 2026.4.25 contains a privilege escalation vulnerability in internal and webchat command authentication that allows sender... (6.5 MEDIUM)
- CVE-2026-53853 — OpenClaw before 2026.5.12 contains an argument pattern validation bypass in the exec allowlist that allows attackers to execute disallowe... (8.3 HIGH)
- CVE-2026-5149 — The RTMKit plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.0.7 This is due to the g... (6.5 MEDIUM)