VulnerableCode Package Details - pkg:pypi/litellm@1.79.0.dev1

Search for packages

Vulnerability	Summary	Fixed by
VCID-1yds-ecc9-qubt Aliases: CVE-2026-42271 GHSA-v4p8-mg3p-g94g	LiteLLM: Authenticated command execution via MCP stdio test endpoints ### Impact Two endpoints used to preview an MCP server before saving it — `POST /mcp-rest/test/connection` and `POST /mcp-rest/test/tools/list` — accepted a full server configuration in the request body, including the `command`, `args`, and `env` fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host. ### Patches Fixed in `1.83.7`. Both test endpoints now require the `PROXY_ADMIN` role, bringing them into line with the save endpoint. ### Workarounds If upgrading is not immediately possible, developers should block `POST /mcp-rest/test/connection` and `POST /mcp-rest/test/tools/list` at their reverse proxy or API gateway.	1.83.7 Affected by 0 other vulnerabilities.
VCID-8w8k-9sxr-dyd7 Aliases: CVE-2026-35030 GHSA-jjhc-v7c2-5hh6	litellm: LiteLLM: Authentication bypass and privilege escalation via OIDC userinfo cache key collision	1.83.0 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-da6b-spaz-tkd7 Aliases: CVE-2026-35029 GHSA-53mr-6c8q-9789	litellm: LiteLLM: Remote code execution and privilege escalation via unrestricted proxy configuration endpoint	1.83.0 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-xjfb-y3du-3bgg Aliases: GHSA-69x8-hrgq-fjj8	LiteLLM: Password hash exposure and pass-the-hash authentication bypass ### Impact Three issues combine into a full authentication bypass chain: 1. Weak hashing: User passwords are stored as unsalted SHA-256 hashes, making them vulnerable to rainbow table attacks and trivially identifying users with identical passwords. 2. Hash exposure: Multiple API endpoints (/user/info, /user/update, /spend/users) return the password hash field in responses to any authenticated user regardless of role. Plaintext passwords could also potentially be exposed in certain scenarios. 4. Pass-the-hash: The /v2/login endpoint accepts the raw SHA-256 hash as a valid password without re-hashing, allowing direct login with a stolen An already authenticated user can retrieve another user's password hash from the API and use it to log in as that user. This enables full privilege escalation in three HTTP requests. ### Patches Fixed in v1.83.0. Passwords are now hashed with scrypt (random 16-byte salt, n=16384, r=8, p=1). Password hashes are stripped from all API responses. Existing SHA-256 hashes are transparently migrated on next login.	1.83.0 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-1yds-ecc9-qubt
Aliases:
CVE-2026-42271
GHSA-v4p8-mg3p-g94g

LiteLLM: Authenticated command execution via MCP stdio test endpoints ### Impact Two endpoints used to preview an MCP server before saving it — `POST /mcp-rest/test/connection` and `POST /mcp-rest/test/tools/list` — accepted a full server configuration in the request body, including the `command`, `args`, and `env` fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host. ### Patches Fixed in **`1.83.7`**. Both test endpoints now require the `PROXY_ADMIN` role, bringing them into line with the save endpoint. ### Workarounds If upgrading is not immediately possible, developers should block `POST /mcp-rest/test/connection` and `POST /mcp-rest/test/tools/list` at their reverse proxy or API gateway.

1.83.7
Affected by 0 other vulnerabilities.

VCID-8w8k-9sxr-dyd7
Aliases:
CVE-2026-35030
GHSA-jjhc-v7c2-5hh6

litellm: LiteLLM: Authentication bypass and privilege escalation via OIDC userinfo cache key collision

1.83.0
Affected by 3 other vulnerabilities.

VCID-da6b-spaz-tkd7
Aliases:
CVE-2026-35029
GHSA-53mr-6c8q-9789

litellm: LiteLLM: Remote code execution and privilege escalation via unrestricted proxy configuration endpoint

1.83.0
Affected by 3 other vulnerabilities.

VCID-xjfb-y3du-3bgg
Aliases:
GHSA-69x8-hrgq-fjj8

LiteLLM: Password hash exposure and pass-the-hash authentication bypass ### Impact Three issues combine into a full authentication bypass chain: 1. Weak hashing: User passwords are stored as unsalted SHA-256 hashes, making them vulnerable to rainbow table attacks and trivially identifying users with identical passwords. 2. Hash exposure: Multiple API endpoints (/user/info, /user/update, /spend/users) return the password hash field in responses to any authenticated user regardless of role. Plaintext passwords could also potentially be exposed in certain scenarios. 4. Pass-the-hash: The /v2/login endpoint accepts the raw SHA-256 hash as a valid password without re-hashing, allowing direct login with a stolen An already authenticated user can retrieve another user's password hash from the API and use it to log in as that user. This enables full privilege escalation in three HTTP requests. ### Patches Fixed in v1.83.0. Passwords are now hashed with scrypt (random 16-byte salt, n=16384, r=8, p=1). Password hashes are stripped from all API responses. Existing SHA-256 hashes are transparently migrated on next login.

1.83.0
Affected by 3 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-06T08:17:59.986461+00:00	GitLab Importer	Affected by	VCID-1yds-ecc9-qubt	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/litellm/CVE-2026-42271.yml	38.6.0
2026-06-06T07:50:35.729521+00:00	GitLab Importer	Affected by	VCID-xjfb-y3du-3bgg	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/litellm/GHSA-69x8-hrgq-fjj8.yml	38.6.0
2026-06-06T07:44:20.096567+00:00	GitLab Importer	Affected by	VCID-da6b-spaz-tkd7	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/litellm/CVE-2026-35029.yml	38.6.0
2026-06-06T07:44:00.338248+00:00	GitLab Importer	Affected by	VCID-8w8k-9sxr-dyd7	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/litellm/CVE-2026-35030.yml	38.6.0