CVE-2026-108575: 
Chainguard Análisis y mitigación de vulnerabilidades

CVE-2026-108575 is an improper authorization vulnerability in BerriAI LiteLLM affecting all versions up to and including 1.94.0. The flaw resides in the get_secret function within secret_managers/main.py, where manipulation of the api_key argument allows an authenticated remote attacker to bypass authorization controls in the Secret Resolution component. It was disclosed on October 11, 2026, with the exploit made public at the time of disclosure; the vendor did not respond to prior contact. It carries a CVSS v3.1 base score of 6.3 (Medium) and a CVSS v4.0 base score of 2.1 (Low) (Red Hat Advisory, GitHub Advisory).

The vulnerability is rooted in improper authorization (CWE-285), incorrect privilege assignment (CWE-266), and authorization bypass through user-controlled key (CWE-639) within LiteLLM's secret resolution mechanism. Specifically, the get_secret function in secret_managers/main.py does not adequately validate or enforce authorization on the api_key parameter, allowing a low-privileged attacker to supply a manipulated value and gain access to secrets or resources beyond their intended authorization scope. The attack requires network access and low-level privileges (e.g., a valid but unprivileged API key), with no user interaction needed. A proof-of-concept asset has been publicly referenced via GitHub (Red Hat Bugzilla, GitHub Advisory).

Successful exploitation allows a remote, low-privileged attacker to bypass authorization controls in LiteLLM's secret resolution component, potentially accessing protected secrets such as API keys or credentials managed by the system. The impact spans confidentiality (unauthorized access to secrets), integrity (potential unauthorized modification of secret-related data), and availability (limited disruption). Because LiteLLM acts as a proxy/gateway for large language model APIs, exposure of managed secrets could enable further lateral movement or abuse of downstream AI services (Red Hat Advisory, GitHub Advisory).

A proof-of-concept exploit has been publicly disclosed and referenced via a GitHub asset attachment at the time of CVE publication, though no confirmed in-the-wild exploitation has been reported (Red Hat Bugzilla). The CVSS v4.0 exploit maturity is rated "Proof of Concept" (E:P). The EPSS score is 0.0, indicating a currently low probability of widespread exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (GitHub Advisory).

1. Reconnaissance: Identify internet-facing LiteLLM instances (versions up to 1.94.0) using network scanning tools or by querying public repositories/cloud deployments for exposed LiteLLM API endpoints.
2. Obtain low-privileged access: Acquire a valid but low-privileged API key for the target LiteLLM instance (e.g., via a free trial, leaked credential, or social engineering).
3. Craft malicious request: Send a crafted HTTP request to the LiteLLM API endpoint that invokes the get_secret function in secret_managers/main.py, manipulating the api_key parameter value to reference secrets or resources belonging to other users or higher-privilege contexts.
4. Bypass authorization: Due to insufficient validation in get_secret, the manipulated api_key parameter bypasses authorization checks, granting access to protected secrets or resources.
5. Exfiltrate secrets: Extract the returned secret values (e.g., third-party LLM API keys, credentials) from the API response for further abuse or lateral movement to downstream AI services (Red Hat Bugzilla, GitHub Advisory).

• Network: Unusual or repeated API requests to LiteLLM endpoints invoking secret resolution functionality (e.g., endpoints that trigger get_secret) from unexpected source IPs or with anomalous api_key parameter values.
• Logs: LiteLLM application logs showing access to secret_managers/main.py's get_secret function with api_key values that do not correspond to the authenticated user's assigned keys; authorization errors or unexpected secret retrieval events.
• Application Behavior: Unexpected retrieval or exposure of secrets belonging to other users or higher-privilege accounts; anomalous downstream API calls to LLM providers using credentials not associated with the requesting user.

The Red Hat Bugzilla entry tracks a patch for this vulnerability; users should monitor the Red Hat advisory and apply any available fixes promptly (Red Hat Bugzilla). As an immediate workaround, implement strict server-side validation of the api_key parameter in the get_secret function to ensure it is bound to the authenticated user's context. Additionally, restrict network access to LiteLLM API endpoints to trusted clients only, and audit secret access logs for anomalous activity. Upgrading to a version beyond 1.94.0 that includes the authorization fix is the recommended long-term remediation (GitHub Advisory).

The vulnerability was reported to the vendor (BerriAI) prior to public disclosure, but the vendor did not respond. Red Hat tracked the issue via Bugzilla and the CVE was published through VulDB as the CNA. No notable independent researcher commentary or significant media coverage has been identified beyond standard CVE aggregator postings (Red Hat Bugzilla, Red Hat Advisory).