Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in LiteLLM allows any user with existing access to elevate their privileges to administrator. This means an attacker could gain full control over all users, teams, keys, models, and prompt history within the LiteLLM instance. Teams should pay attention because this could lead to significant data compromise and service disruption.
- Unauthorized administrative access.
- Affects all users and data.
- Exists in a common LLM gateway.
Attack Path
How an attacker could exploit the issue
An attacker with low-privilege access can escalate their privileges within LiteLLM by exploiting the user update endpoint. By targeting the `/user/update` endpoint, they can modify their own user role to `proxy_admin`, gaining complete administrative control over the system. This allows them to access all users, teams, keys, models, and prompt history.
- Requires authenticated user access.
- Targets the user update endpoint.
- Exploits an org_admin's legitimate access.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability allows a user with legitimate access to update their own role to `proxy_admin`, granting them full administrative control over the LiteLLM instance. Attackers are likely to find this appealing because it offers a direct path to privilege escalation, potentially leading to data exfiltration or unauthorized system changes without needing to exploit additional flaws. The primary concern is the ease of exploitation for any authenticated user who can reach the `/user/update` endpoint.
- No evidence of public exploits.
- Vendor patched within 4 days.
- No KEV listing.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching LiteLLM to version 1.83.10 to prevent unauthorized role changes that grant administrative access. If immediate patching isn't feasible, restrict access to the `/user/update` endpoint and monitor for any unusual administrative activity.
- Apply LiteLLM 1.83.10 patch.
- Limit `/user/update` endpoint access.
- Monitor for administrative privilege escalation.
