NewsThe Register — Security
LiteLLM supply chain attack started with an exposed master key
Teaser from the source
A 'strong illustration of the risks associated with failing to rotate a potentially exposed key'
This is the RSS-feed teaser. Read the full article at the original source.
Read at The Register — SecurityMore on LiteLLM
Other advisories
- Not ratedosv:GHSA-g5ff-637f-6q2mLiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`
- Highghsa:GHSA-g5ff-637f-6q2mLiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`
- Mediumghsa:GHSA-hhww-mrg2-969hLiteLLM vulnerable to reflected XSS in /sso/debug/callback
- Not ratedosv:GHSA-hhww-mrg2-969hLiteLLM vulnerable to reflected XSS in /sso/debug/callback
- CriticalCVE-2026-114612LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
- CriticalCVE-2026-114612LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
- Not ratedosv:CLEANSTART-2026-GC08541Security fix for GHSA-6q48-6c7w-9gw2 applied in: litellm-database 1.104.2-r0
- CriticalCVE-2026-114612LiteLLM: Schwachstelle ermöglicht Privilegieneskalation und Codeausführung
Other news entries
- Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release PipelineNewsThe Hacker News
- LiteLLM: Schwachstelle ermöglicht Privilegieneskalation und CodeausführungVulnerabilityBSI CERT-Bund
- LiteLLM Compromised in Fresh Supply Chain AttackNewsSecurityWeek
- LiteLLM release pipeline hacked to distribute info-stealer malwareNewsBleepingComputer
- ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 MoreNewsThe Hacker News
- LiteLLM release pipeline hacked to distribute credential-stealing malwareNewsCSO Online
- LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package ReleaseNewsThe Hacker News
- LiteLLM supply chain attack hoovers up passwords and secretsNewsThe Register — Security
ID