CVE-2026-108575: 
Chainguard vulnerability analysis and mitigation

CVE-2026-108575 is an improper authorization vulnerability in BerriAI LiteLLM affecting all versions up to and including 1.94.0. The flaw resides in the get_secret function within secret_managers/main.py, where manipulation of the api_key argument allows an authenticated attacker to bypass authorization controls in the Secret Resolution component. The vulnerability was published on October 11, 2026, and the exploit has been disclosed publicly. The vendor was contacted prior to disclosure but did not respond. It carries a CVSS v3.1 base score of 6.3 (Medium) and a CVSS v4.0 base score of 2.1 (Low) (Red Hat Advisory, Github Advisory, Red Hat Bugzilla).

The root cause is improper authorization (CWE-285), compounded by authorization bypass through user-controlled key (CWE-639) and incorrect privilege assignment (CWE-266). The vulnerable code path is the get_secret function in secret_managers/main.py, which handles secret resolution for LiteLLM's proxy/gateway layer. An attacker with low-level authenticated access can manipulate the api_key parameter passed to this function to bypass authorization checks, potentially gaining access to secrets or resources they are not entitled to retrieve. The attack requires no user interaction and no special deployment conditions beyond having a valid (low-privilege) account (Red Hat Bugzilla, Github Advisory).

Successful exploitation allows an attacker to bypass authorization controls in LiteLLM's secret resolution mechanism, potentially exposing protected secrets such as API keys for downstream LLM providers (e.g., OpenAI, Anthropic, Azure). The confidentiality, integrity, and availability of the vulnerable system are each assessed as low impact, meaning partial exposure of secrets, limited unauthorized modification, and minor service disruption are possible outcomes. Because LiteLLM acts as a proxy/gateway to multiple AI model providers, unauthorized access to stored secrets could enable lateral movement to those provider accounts or services (Red Hat Advisory, Github Advisory).

A proof-of-concept exploit has been publicly disclosed (referenced via a GitHub asset attachment), though no weaponized exploit kit or active in-the-wild exploitation has been confirmed at this time. The EPSS score is approximately 0.201% (9th percentile), indicating a low near-term exploitation probability. The CVE status is marked "Deferred" by Red Hat, and it is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (Github Advisory, Red Hat Advisory).

1. Reconnaissance: Identify internet-facing LiteLLM proxy instances (versions ≤ 1.94.0) using tools like Shodan or Censys, or by reviewing exposed API endpoints.
2. Obtain low-privilege credentials: Register or obtain a low-privilege API key for the target LiteLLM instance (e.g., via a free trial or compromised credentials).
3. Craft malicious request: Send an API request to the LiteLLM proxy that invokes the secret resolution path, manipulating the api_key parameter in secret_managers/main.py's get_secret function to reference secrets belonging to other users or higher-privilege contexts.
4. Bypass authorization: Due to insufficient validation of the api_key argument, the server resolves and returns the requested secret without enforcing proper ownership or privilege checks.
5. Exfiltrate secrets: Use the retrieved secrets (e.g., provider API keys) to make unauthorized calls to downstream LLM providers or pivot to other services (Red Hat Bugzilla, Github Advisory).

• Network: Unusual or repeated API requests to LiteLLM secret resolution endpoints from low-privilege accounts; requests referencing api_key values belonging to other users or service accounts.
• Logs: LiteLLM application logs showing get_secret calls with unexpected or cross-user api_key parameter values; authorization errors or anomalous secret lookups in secret_managers/main.py code paths.
• File System: No specific file artifacts expected, but review LiteLLM configuration files for unauthorized modifications to stored secrets or provider credentials.
• Process/Behavior: Unexpected downstream API calls to LLM providers (OpenAI, Anthropic, Azure, etc.) using credentials not associated with the initiating user account.

Users should upgrade BerriAI LiteLLM to a version beyond 1.94.0 as soon as a patched release is available. In the interim, implement strict validation of the api_key parameter within the secret resolution mechanism and add additional server-side authorization checks to ensure users can only resolve secrets they own. Network-level controls such as restricting access to the LiteLLM proxy to trusted networks and enforcing strong authentication can reduce exposure. Monitor Red Hat Bugzilla (Bug 2549217) and the GitHub Advisory for patch availability updates (Red Hat Bugzilla, Red Hat Advisory).

The vulnerability was assigned and tracked by Red Hat's Product Security team (Bug 2549217), though it is currently in "NEW" status with no fix version listed, reflecting the vendor's lack of response to the initial disclosure. The GitHub Advisory Database has published the advisory as "Unreviewed" with low severity. No notable independent researcher commentary, media coverage, or significant social media discussion has been identified beyond automated CVE feed aggregation.