CVE-2026-12773: A weakness has been identified in BerriAI litellm up to 1.59.8. (23rd Jun 2026)

Preface: LiteLLM is widely deployed by AI platforms because it provides a free, open-source proxy that unifies access to over 100 LLMs (like OpenAI, Anthropic, and local models) under a single OpenAI-compatible API format. It simplifies multi-model integration while enabling enterprise-grade cost tracking, spend limits, and rate limiting.

Background: LiteLLM (BerriAI) uses user_api_key_auth[.]py to handle backend API key validation, user tracking, and model permission routing. To implement custom authentication, you write a Python script with a user_api_key_auth(request, api_key) function and pass the file path to your proxy configuration.

About Auth Workflow When a request arrives at the proxy, the workflow follows these steps:

Request Interception: The proxy receives the HTTP request (e.g., /v1/chat/completions) and inspects the Authorization: Bearer <api_key> header.

Custom Verification: LiteLLM runs the user_api_key_auth function defined in your custom script. This function checks the <api_key> against an external database, a hardcoded master key, or a third-party auth service.

Pydantic Object Return: On success, your function returns a UserAPIKeyAuth Pydantic object (which tracks user limits, key max budgets, and allowed models).

Policy Enforcement: If configured, the proxy enforces rate limits, model allowlists, and per-model spending budgets before passing the request to the LLM provider

Ref: A Pydantic object return refers to configuring a Python function, API framework, or AI framework to output structured data in the form of a validated Pydantic model instance.

Security Advisory: CVE-2026-12773 (LiteLLM Proxy Auth Bypass)

  • The Issue: Versions of BerriAI LiteLLM up to 1.59.8 contain a weakness in the custom proxy authentication handler. If post-custom checks are disabled, broken custom scripts can lead to financial and structural compromise via key theft or cross-environment token reuse.
  • The Impact: Attackers can bypass request controls, map backend routes, and orchestrate Denial of Wallet (DoW) attacks by draining upstream AI balances.

Official announcement: Please refer to the link for details – https://www.tenable.com/cve/CVE-2026-12773

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.