CVE-2026-108574: 
Chainguard vulnerability analysis and mitigation

CVE-2026-108574 is an authorization bypass vulnerability in BerriAI LiteLLM's Spend Tracking component that allows authenticated remote attackers to access spend logs belonging to other users or sessions by manipulating the session_id parameter. It affects the ui_view_session_spend_logs function in litellm/proxy/spend_tracking/spend_management_endpoints.py across all LiteLLM versions from 1.0 through 1.95.0. The vulnerability was published on October 11, 2026, with a fix available in version 1.96.0. It carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 2.1 (Low) (Github Advisory, bugzilla.redhat.com).

The root cause is improper authorization (CWE-285) combined with authorization bypass through a user-controlled key (CWE-639). The ui_view_session_spend_logs function in the Spend Tracking component does not enforce ownership checks on the session_id parameter, allowing any authenticated caller to supply an arbitrary session identifier and retrieve spend log data associated with that session. The fix introduced in commit 722d9ffa4f6c5ae15702ab9ab2c5f6bf1688308b adds caller-scoped spend report endpoints with explicit authorization logic that clamps non-admin callers to their own identity and raises HTTP 403 for cross-identity requests (Github Advisory, LiteLLM Commit).

Successful exploitation allows any authenticated user to read spend tracking logs — including model usage, token counts, and cost data — for sessions or users they do not own. The impact is limited to confidentiality of spend/billing metadata; there is no integrity or availability impact, and no evidence of lateral movement or code execution risk. In multi-tenant LiteLLM proxy deployments, this could expose sensitive operational and cost information across organizational boundaries (Github Advisory, bugzilla.redhat.com).

A proof-of-concept exploit has been published and is referenced in the advisory, though no specific PoC code repository is publicly linked. The EPSS score is approximately 0.238% (14th percentile), indicating a low near-term exploitation probability. There is no evidence of active in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires low-privilege authenticated access and is not automatable per NVD SSVC assessment (Github Advisory, bugzilla.redhat.com).

1. Obtain authenticated access: Acquire a valid LiteLLM API key (e.g., via a free trial, shared environment, or compromised credential) for a LiteLLM proxy instance running version ≤ 1.95.0.
2. Identify the vulnerable endpoint: Locate the /spend/logs/session/ui endpoint on the target LiteLLM proxy server.
3. Enumerate or guess session IDs: Collect known or guessable session_id values from prior interactions, logs, or by brute-forcing common session identifier formats.
4. Send crafted request: Issue an authenticated HTTP GET request to the spend logs endpoint with a manipulated session_id parameter belonging to another user or session, e.g.:

   GET /spend/logs/session/ui?session_id=<target_session_id>
   Authorization: Bearer <attacker_api_key>

5. Retrieve unauthorized data: The server returns spend log data (model usage, token counts, cost breakdown) for the targeted session without verifying ownership, completing the authorization bypass (Github Advisory, LiteLLM Commit).

• Network: Repeated authenticated GET requests to /spend/logs/session/ui with varying session_id values from a single source IP, particularly with session IDs not associated with the requesting API key.
• Logs: LiteLLM proxy access logs showing a single API key querying spend logs for multiple distinct session_id values in rapid succession; HTTP 200 responses to cross-session spend log queries on versions ≤ 1.95.0.
• Application Behavior: Spend log queries returning data for sessions that do not belong to the authenticated caller's key, user, or team scope.

Upgrade BerriAI LiteLLM to version 1.96.0 or later, which includes patch 722d9ffa4f6c5ae15702ab9ab2c5f6bf1688308b that enforces caller-scoped authorization on spend tracking endpoints. No configuration-based workaround is documented; upgrading is the only confirmed remediation. As an interim measure, consider restricting network access to the LiteLLM proxy's spend tracking endpoints to trusted internal networks or admin users only (LiteLLM Release, Github Advisory).