chore(deps): update dependency litellm to v1.83.7 [security]#462
Open
renovate[bot] wants to merge 1 commit intomasterfrom
Open
chore(deps): update dependency litellm to v1.83.7 [security]#462renovate[bot] wants to merge 1 commit intomasterfrom
renovate[bot] wants to merge 1 commit intomasterfrom
Conversation
renovate
Bot
changed the title
renovate
Bot
changed the title
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/pypi-litellm-vulnerability
branch
from
dfa2fb1 to
f3f0cb4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.75.8→1.83.7LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint
CVE-2026-35029 / GHSA-53mr-6c8q-9789
More information
Details
Impact
The
/config/update endpointdoes not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to do the following:Patches
Fixed in v1.83.0. The endpoint now requires
proxy_adminrole.Workarounds
Restrict API key distribution. There is no configuration-level workaround.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
LiteLLM: Authentication bypass via OIDC userinfo cache key collision
CVE-2026-35030 / GHSA-jjhc-v7c2-5hh6
More information
Details
Impact
When JWT authentication is enabled (
enable_jwt_auth: true), the OIDC userinfo cache usestoken[:20]as the cache key. JWT headers produced by the same signing algorithm generate identical first 20 characters.This configuration option is not enabled by default. Most instances are not affected.
An unauthenticated attacker can craft a token whose first 20 characters match a legitimate user's cached token. On cache hit, the attacker inherits the legitimate user's identity and permissions. This affects deployments with JWT/OIDC authentication enabled.
Patches
Fixed in v1.83.0. The cache key now uses the full hash of the JWT token.
Workarounds
Disable OIDC userinfo caching by setting the cache TTL to 0, or disable JWT authentication entirely.
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
LiteLLM: Password hash exposure and pass-the-hash authentication bypass
GHSA-69x8-hrgq-fjj8
More information
Details
Impact
Three issues combine into a full authentication bypass chain:
An already authenticated user can retrieve another user's password hash from the API and use it to log in as that user. This enables full privilege escalation in three HTTP requests.
Patches
Fixed in v1.83.0. Passwords are now hashed with scrypt (random 16-byte salt, n=16384, r=8, p=1). Password hashes are stripped from all API responses. Existing SHA-256 hashes are transparently migrated on next login.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
LiteLLM: Authenticated command execution via MCP stdio test endpoints
CVE-2026-42271 / GHSA-v4p8-mg3p-g94g
More information
Details
Impact
Two endpoints used to preview an MCP server before saving it —
POST /mcp-rest/test/connectionandPOST /mcp-rest/test/tools/list— accepted a full server configuration in the request body, including thecommand,args, andenvfields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process.The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host.
Patches
Fixed in
1.83.7. Both test endpoints now require thePROXY_ADMINrole, bringing them into line with the save endpoint.Workarounds
If upgrading is not immediately possible, developers should block
POST /mcp-rest/test/connectionandPOST /mcp-rest/test/tools/listat their reverse proxy or API gateway.Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
BerriAI/litellm (litellm)
v1.82.5v1.82.3v1.82.1What's Changed
New Contributors
Full Changelog: BerriAI/litellm@litellm_presidio-dev-v1.81.16...1.82.1
v1.81.13What's Changed
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.