Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/809126?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/809126?format=api", "purl": "pkg:pypi/litellm@1.52.12", "type": "pypi", "namespace": "", "name": "litellm", "version": "1.52.12", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "1.83.7", "latest_non_vulnerable_version": "1.83.10", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/56846?format=api", "vulnerability_id": "VCID-4wtj-33ja-dbhu", "summary": "LiteLLM Vulnerable to Denial of Service (DoS)\nA vulnerability in BerriAI/litellm, as of commit 26c03c9, allows unauthenticated users to cause a Denial of Service (DoS) by exploiting the use of ast.literal_eval to parse user input. This function is not safe and is prone to DoS attacks, which can crash the litellm Python server.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-10188", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0027", "scoring_system": "epss", "scoring_elements": "0.50725", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.0027", "scoring_system": "epss", "scoring_elements": "0.50711", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.0027", "scoring_system": "epss", "scoring_elements": "0.5073", "published_at": "2026-06-06T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-10188" }, { "reference_url": "https://github.com/BerriAI/litellm", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/BerriAI/litellm" }, { "reference_url": "https://github.com/berriai/litellm/commit/21156ff5d0d84a7dd93f951ca033275c77e4f73c", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/berriai/litellm/commit/21156ff5d0d84a7dd93f951ca033275c77e4f73c" }, { "reference_url": "https://huntr.com/bounties/96a32812-213c-4819-ba4e-36143d35e95b", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://huntr.com/bounties/96a32812-213c-4819-ba4e-36143d35e95b" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10188", "reference_id": "CVE-2024-10188", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10188" }, { "reference_url": "https://github.com/advisories/GHSA-gw2q-qw9j-rgv7", "reference_id": "GHSA-gw2q-qw9j-rgv7", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-gw2q-qw9j-rgv7" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/84469?format=api", "purl": "pkg:pypi/litellm@1.53.1.dev1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-8w8k-9sxr-dyd7" }, { "vulnerability": "VCID-9318-6tg8-zqbp" }, { "vulnerability": "VCID-9vx2-e7qb-jydd" }, { "vulnerability": "VCID-da6b-spaz-tkd7" }, { "vulnerability": "VCID-xjfb-y3du-3bgg" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/litellm@1.53.1.dev1" } ], "aliases": [ "CVE-2024-10188", "GHSA-gw2q-qw9j-rgv7" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-4wtj-33ja-dbhu" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/63545?format=api", "vulnerability_id": "VCID-8w8k-9sxr-dyd7", "summary": "litellm: LiteLLM: Authentication bypass and privilege escalation via OIDC userinfo cache key collision", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-35030.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-35030.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-35030", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00048", "scoring_system": "epss", "scoring_elements": "0.15442", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.00048", "scoring_system": "epss", "scoring_elements": "0.1549", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.00048", "scoring_system": "epss", "scoring_elements": "0.15482", "published_at": "2026-06-06T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-35030" }, { "reference_url": "https://github.com/BerriAI/litellm", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.4", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/BerriAI/litellm" }, { "reference_url": "https://github.com/BerriAI/litellm/security/advisories/GHSA-jjhc-v7c2-5hh6", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "9.4", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2026-04-07T14:24:02Z/" } ], "url": "https://github.com/BerriAI/litellm/security/advisories/GHSA-jjhc-v7c2-5hh6" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35030", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.4", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35030" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455509", "reference_id": "2455509", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455509" }, { "reference_url": "https://github.com/advisories/GHSA-jjhc-v7c2-5hh6", "reference_id": "GHSA-jjhc-v7c2-5hh6", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-jjhc-v7c2-5hh6" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:13545", "reference_id": "RHSA-2026:13545", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:13545" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/109978?format=api", "purl": "pkg:pypi/litellm@1.83.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1yds-ecc9-qubt" }, { "vulnerability": "VCID-a3ga-un4n-vbhd" }, { "vulnerability": "VCID-h23p-8u9p-fbc5" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/litellm@1.83.0" } ], "aliases": [ "CVE-2026-35030", "GHSA-jjhc-v7c2-5hh6" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-8w8k-9sxr-dyd7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/56909?format=api", "vulnerability_id": "VCID-9318-6tg8-zqbp", "summary": "LiteLLM Has an Improper Authorization Vulnerability\nAn improper authorization vulnerability exists in the main-latest version of BerriAI/litellm. When a user with the role 'internal_user_viewer' logs into the application, they are provided with an overly privileged API key. This key can be used to access all the admin functionality of the application, including endpoints such as '/users/list' and '/users/get_users'. This vulnerability allows for privilege escalation within the application, enabling any account to become a PROXY ADMIN.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-0628", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00274", "scoring_system": "epss", "scoring_elements": "0.50983", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.00274", "scoring_system": "epss", "scoring_elements": "0.51004", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00274", "scoring_system": "epss", "scoring_elements": "0.50998", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-0628" }, { "reference_url": "https://github.com/BerriAI/litellm", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/BerriAI/litellm" }, { "reference_url": "https://github.com/berriai/litellm/commit/566d9354aab4215091b2e51ad0333e948125fa1b", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-03-20T17:49:22Z/" } ], "url": "https://github.com/berriai/litellm/commit/566d9354aab4215091b2e51ad0333e948125fa1b" }, { "reference_url": "https://huntr.com/bounties/6c0e2f75-2d03-42f9-9530-e16a973317fc", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-03-20T17:49:22Z/" } ], "url": "https://huntr.com/bounties/6c0e2f75-2d03-42f9-9530-e16a973317fc" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0628", "reference_id": "CVE-2025-0628", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0628" }, { "reference_url": "https://github.com/advisories/GHSA-fjcf-3j3r-78rp", "reference_id": "GHSA-fjcf-3j3r-78rp", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-fjcf-3j3r-78rp" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/84506?format=api", "purl": "pkg:pypi/litellm@1.61.15", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-8w8k-9sxr-dyd7" }, { "vulnerability": "VCID-da6b-spaz-tkd7" }, { "vulnerability": "VCID-xjfb-y3du-3bgg" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/litellm@1.61.15" } ], "aliases": [ "CVE-2025-0628", "GHSA-fjcf-3j3r-78rp" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9318-6tg8-zqbp" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/56952?format=api", "vulnerability_id": "VCID-9vx2-e7qb-jydd", "summary": "LiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP Request\nA Denial of Service (DoS) vulnerability exists in berriai/litellm version v1.44.5. This vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. The server continuously processes each character, leading to excessive resource consumption and rendering the service unavailable. The issue is unauthenticated and does not require any user interaction, impacting all users of the service.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-8984", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00641", "scoring_system": "epss", "scoring_elements": "0.71004", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.00641", "scoring_system": "epss", "scoring_elements": "0.70994", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.00641", "scoring_system": "epss", "scoring_elements": "0.71011", "published_at": "2026-06-06T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-8984" }, { "reference_url": "https://github.com/BerriAI/litellm", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/BerriAI/litellm" }, { "reference_url": "https://github.com/BerriAI/litellm/blob/8c5ff150f6142608ffe968e4e68429f978fda187/litellm/tests/test_spend_logs.py#L242", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/BerriAI/litellm/blob/8c5ff150f6142608ffe968e4e68429f978fda187/litellm/tests/test_spend_logs.py#L242" }, { "reference_url": "https://github.com/BerriAI/litellm/commit/4f49f836aa844ac9b6bfbeff27e6f6b2b9cf3f61", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/BerriAI/litellm/commit/4f49f836aa844ac9b6bfbeff27e6f6b2b9cf3f61" }, { "reference_url": "https://huntr.com/bounties/554fc76b-3097-4223-b4cf-110b853e9355", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-03-20T17:54:05Z/" } ], "url": "https://huntr.com/bounties/554fc76b-3097-4223-b4cf-110b853e9355" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8984", "reference_id": "CVE-2024-8984", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8984" }, { "reference_url": "https://github.com/advisories/GHSA-fh2c-86xm-pm2x", "reference_id": "GHSA-fh2c-86xm-pm2x", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-fh2c-86xm-pm2x" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/84550?format=api", "purl": "pkg:pypi/litellm@1.56.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-8w8k-9sxr-dyd7" }, { "vulnerability": "VCID-9318-6tg8-zqbp" }, { "vulnerability": "VCID-da6b-spaz-tkd7" }, { "vulnerability": "VCID-xjfb-y3du-3bgg" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/litellm@1.56.2" } ], "aliases": [ "CVE-2024-8984", "GHSA-fh2c-86xm-pm2x" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9vx2-e7qb-jydd" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/63546?format=api", "vulnerability_id": "VCID-da6b-spaz-tkd7", "summary": "litellm: LiteLLM: Remote code execution and privilege escalation via unrestricted proxy configuration endpoint", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-35029.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-35029.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-35029", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.1938", "scoring_system": "epss", "scoring_elements": "0.9551", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.1938", "scoring_system": "epss", "scoring_elements": "0.95505", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.1938", "scoring_system": "epss", "scoring_elements": "0.95508", "published_at": "2026-06-06T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-35029" }, { "reference_url": "http://seclists.org/fulldisclosure/2026/Apr/17", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://seclists.org/fulldisclosure/2026/Apr/17" }, { "reference_url": "https://github.com/BerriAI/litellm", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/BerriAI/litellm" }, { "reference_url": "https://github.com/BerriAI/litellm/security/advisories/GHSA-53mr-6c8q-9789", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-04-06T18:41:02Z/" } ], "url": "https://github.com/BerriAI/litellm/security/advisories/GHSA-53mr-6c8q-9789" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35029", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35029" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455474", "reference_id": "2455474", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455474" }, { "reference_url": "https://github.com/advisories/GHSA-53mr-6c8q-9789", "reference_id": "GHSA-53mr-6c8q-9789", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-53mr-6c8q-9789" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:13545", "reference_id": "RHSA-2026:13545", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:13545" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/109978?format=api", "purl": "pkg:pypi/litellm@1.83.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1yds-ecc9-qubt" }, { "vulnerability": "VCID-a3ga-un4n-vbhd" }, { "vulnerability": "VCID-h23p-8u9p-fbc5" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/litellm@1.83.0" } ], "aliases": [ "CVE-2026-35029", "GHSA-53mr-6c8q-9789" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-da6b-spaz-tkd7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/89052?format=api", "vulnerability_id": "VCID-xjfb-y3du-3bgg", "summary": "LiteLLM: Password hash exposure and pass-the-hash authentication bypass\n### Impact\n\nThree issues combine into a full authentication bypass chain:\n\n1. Weak hashing: User passwords are stored as unsalted SHA-256 hashes, making them vulnerable to rainbow table attacks and trivially identifying users with identical passwords.\n2. Hash exposure: Multiple API endpoints (/user/info, /user/update, /spend/users) return the password hash field in responses to any authenticated user regardless of role. Plaintext passwords could also potentially be exposed in certain scenarios.\n4. Pass-the-hash: The /v2/login endpoint accepts the raw SHA-256 hash as a valid password without re-hashing, allowing direct login with a stolen\n\nAn already authenticated user can retrieve another user's password hash from the API and use it to log in as that user. This enables full privilege escalation in three HTTP requests.\n\n### Patches\n\nFixed in v1.83.0. Passwords are now hashed with scrypt (random 16-byte salt, n=16384, r=8, p=1). Password hashes are stripped from all API responses. Existing SHA-256 hashes are transparently migrated on next login.", "references": [ { "reference_url": "https://github.com/BerriAI/litellm", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/BerriAI/litellm" }, { "reference_url": "https://github.com/BerriAI/litellm/security/advisories/GHSA-69x8-hrgq-fjj8", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "8.6", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/BerriAI/litellm/security/advisories/GHSA-69x8-hrgq-fjj8" }, { "reference_url": "https://github.com/advisories/GHSA-69x8-hrgq-fjj8", "reference_id": "GHSA-69x8-hrgq-fjj8", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-69x8-hrgq-fjj8" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/109978?format=api", "purl": "pkg:pypi/litellm@1.83.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1yds-ecc9-qubt" }, { "vulnerability": "VCID-a3ga-un4n-vbhd" }, { "vulnerability": "VCID-h23p-8u9p-fbc5" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/litellm@1.83.0" } ], "aliases": [ "GHSA-69x8-hrgq-fjj8" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-xjfb-y3du-3bgg" } ], "fixing_vulnerabilities": [], "risk_score": "4.5", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/litellm@1.52.12" }