CVE-2026-108574: 
Chainguard Análisis y mitigación de vulnerabilidades

CVE-2026-108574 is an authorization bypass vulnerability in BerriAI LiteLLM's Spend Tracking component that allows authenticated users to access spend logs belonging to other sessions or users by manipulating the session_id argument in the ui_view_session_spend_logs function of litellm/proxy/spend_tracking/spend_management_endpoints.py. It affects all LiteLLM versions from 1.0 through 1.95.0, with version 1.96.0 containing the fix. The vulnerability was published on October 11, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 2.1 (Low) (Github Advisory, Feedly).

The root cause is classified as CWE-285 (Improper Authorization) and CWE-639 (Authorization Bypass Through User-Controlled Key). The ui_view_session_spend_logs function in the Spend Tracking component fails to validate that the authenticated caller is authorized to view spend logs for the requested session_id, allowing any authenticated user to supply an arbitrary session identifier and retrieve spend data for sessions they do not own. The attack is network-based, requires low privileges (a valid API key), and no user interaction. The fix introduced in commit 722d9ffa4f6c5ae15702ab9ab2c5f6bf1688308b adds caller-scoped spend report endpoints with explicit authorization checks that clamp non-admin callers to their own identity (Github Advisory, Patch Commit).

Successful exploitation allows any authenticated user to view spend tracking logs — including model usage, token counts, and cost data — for sessions or users they are not authorized to access. The confidentiality impact is limited to spend/usage metadata rather than LLM content or credentials, and there is no integrity or availability impact. In multi-tenant LiteLLM proxy deployments, this could expose sensitive billing and usage patterns across organizational boundaries (Github Advisory, Feedly).

The vulnerability requires a valid (low-privilege) API key but no special configuration or user interaction, making it straightforward to exploit remotely. The CVSS v4.0 exploit maturity is rated "Proof of Concept" (E:P), and the advisory states the exploit has been published and may be used; however, no confirmed in-the-wild exploitation has been observed. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No specific threat actor attribution is available (Github Advisory, Feedly).

1. Obtain a valid API key: Register or obtain any low-privilege LiteLLM API key for the target proxy instance — no administrative access is required.
2. Identify the target endpoint: Locate the spend tracking UI endpoint, specifically the ui_view_session_spend_logs function accessible via the LiteLLM proxy's spend management API at litellm/proxy/spend_tracking/spend_management_endpoints.py.
3. Enumerate or guess session IDs: Identify valid session_id values belonging to other users or sessions. These may be predictable, leaked in logs, or discoverable through other API responses.
4. Send a crafted request: Issue an authenticated HTTP request to the spend logs endpoint, supplying an arbitrary session_id parameter value corresponding to another user's session (e.g., GET /spend/logs/session/ui?session_id=<target_session_id> with the attacker's API key in the Authorization header).
5. Retrieve unauthorized spend data: The server returns spend log data — including model usage, token counts, and cost breakdowns — for the targeted session without verifying the caller's ownership, completing the authorization bypass (Github Advisory, Patch Commit).

• Network: Repeated or sequential HTTP GET requests to /spend/logs/session/ui or similar spend tracking endpoints with varying session_id parameter values from a single authenticated API key.
• Logs: LiteLLM proxy access logs showing a single API key querying spend logs for multiple distinct session_id values in a short time window, particularly for sessions not associated with that key's user or team.
• Logs: Unusual access patterns to spend management endpoints outside of normal business hours or from unexpected source IPs for a given API key.

Upgrade BerriAI LiteLLM to version 1.96.0 or later, which contains the fix introduced in commit 722d9ffa4f6c5ae15702ab9ab2c5f6bf1688308b. This patch adds caller-scoped spend report endpoints that enforce authorization checks, clamping non-admin callers to their own identity and returning HTTP 403 for unauthorized cross-session access attempts. No configuration-based workaround is available for unpatched versions; upgrading is the only remediation. Additionally, consider implementing audit logging on spend tracking endpoints to detect unauthorized access attempts (Github Advisory, LiteLLM v1.96.0 Release).