External risk intelligence

LiteLLM Proxy Unauthenticated Information Exposure Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.5)

CVE-2026-49468

LiteLLM is designed specifically as an AI Gateway or proxy server to handle API calls. As a centralized gateway service meant to sit between applications and LLM providers, it is commonly deployed as a public or edge-facing service to facilitate these network-based communications.

Litellm

before 1.84.0

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in LiteLLM, an AI gateway that manages communications with large language model APIs. This issue affects how the system handles certain operations, potentially allowing unauthorized access or manipulation. Leadership should be aware of this as it pertains to the systems that leverage LiteLLM for AI interactions.

Issue involves a security flaw in an AI gateway.
Matters because it's a central point for AI API calls.
Confirm relevance and exposure for AI communication systems.

Attack Path

How an attacker could exploit the issue

An attacker could reach this vulnerability by interacting with the LiteLLM proxy server over the network. If the attacker can provide specially crafted input, they might be able to trigger a flaw within the proxy's request handling. Successful exploitation could allow an attacker to gain significant control over the system.

Requires network access.
Triggered by malformed input.
Leads to critical system compromise.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could affect the behavior of the LiteLLM proxy server when processing requests, potentially impacting the availability of downstream LLM APIs. No specific user or system data types, PII, or sensitive information are indicated as directly at risk.

Service availability could be impacted.
Unsanitized inputs may cause unexpected behavior.
Disruption of LLM API access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts LiteLLM, an AI gateway proxy. Teams responsible for managing API gateways, internal platforms, or the applications that route through LiteLLM should lead the response. The first critical step is to identify all instances of LiteLLM within the environment, confirm their exposure and business criticality, and then determine the accountable owner for remediation planning.

Own the issue: Platform or application teams.
Verify first: LiteLLM instances and exposure.
Action: Plan and execute upgrades.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is LiteLLM and why is it used?

LiteLLM is an AI gateway or proxy server designed to standardize communication between applications and various large language model (LLM) providers. By acting as a central interface, it allows developers to use a single, consistent API format to interact with different AI models, abstracting away the underlying provider-specific complexities.

What is the vulnerability class for CVE-2026-49468?

This vulnerability is classified as CWE-290, which involves Authentication Bypass by Spoofing. In the context of CVE-2026-49468, the flaw allows an attacker to manipulate or bypass the security mechanisms that LiteLLM uses to verify the legitimacy of incoming requests. By providing specially crafted input, an unauthorized party may be able to trick the gateway into performing actions as if they were a trusted or authenticated user.

How is the vulnerability in LiteLLM triggered?

The flaw is triggered when an attacker sends specifically crafted network requests to the LiteLLM proxy server. The system fails to properly sanitize or validate these inputs during its request handling process, leading to a compromise. Simply sending standard, legitimate API traffic will not trigger the bug; the exploit requires inputs engineered to deceive the gateway's logic.

Why does Halo Surface Signal categorize this as external?

Halo Surface Signal identifies this as an external threat because LiteLLM functions as an AI gateway, which is inherently designed to sit between your internal applications and external LLM providers. Because it is meant to facilitate these network-based communications, it is frequently deployed in internet-facing or edge-network positions, making it reachable by unauthorized actors across the internet.

What are the first steps to secure my LiteLLM instance?

The immediate priority is to locate all LiteLLM deployments within your infrastructure and confirm whether they are reachable over the network. Once your instances are identified, you must plan an upgrade to version 1.84.0 or later, as this release contains the fix. Coordinate with your platform or application teams to prioritize these updates to mitigate the risk of unauthorized access.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.