LiteLLM alert exposed: three critical CVE reveal the fragility of mutable trust

The chain of failures reported by Obsidian Security against LiteLLM is a hard reminder of how design decisions, absent validations and unique control points can turn a low privilege account into full access to the server. LiteLLM acts as a gateway for more than 100 model suppliers and, in many deployments, processes prompts, responses and sensitive keys, therefore the exposure is proportionally serious: supplier key theft, credentials encryption salt, database URL and ability to alter responses to agents and users.

The operation route chain three critical CVE: CVE-2026-47101 allows you to skip the authorisation by accepting without validating a caller-supplied / updated field; and CVE-2026-47217 is a sandbox leak in the custom code guard that runs Python code with exec (and ends up exiting _ import _ or _ import _ systems. Obsidian qualifies the complete chain in CVSS 9.9, and BerriAI published the complete set of patches in the version v1.83.14-stable, listed in GitHub as published on May 2; updating to that version or later is the first and most urgent action. See the official repository: GitHub - LiteLLM v1.83.14-stable and the researcher's notice on the safety website for general context: Obsidian Security.

Beyond the technical explosion, the geometry of the attack shows a classic lesson: mutable confidence in various layers. The proxy accepted a client-dictated access route and then the rest of the code assumed that that routing door had done all the filtering. That chained trust is the one that allowed a relatively simple failure in virtual key management to become remote server control.

The operational consequence is double and dangerous. On the one hand, an attacker who achieves the chain can read everything that goes through the gateway, including PII, code fragments and secrets that users stick to prompts. On the other hand, and perhaps more subtle but more exploitable by autonomous agents, the attacker can alter transit responses and make an agent or an automated flow perform malicious actions without the model being manipulated by prompt injection: the gateway can forge tool calls and rewrite safety context using internal callbacks that do not appear in the IU.

There are also independent vectors that aggravate the risk: the LiteLLM Model Context Protocol (MCP) support allows a proxy _ admin to register local stdio servers that the proxy launches as subprocesses - a design decision that implies that have proxy _ admin role is, in practice, equivalent to having the ability to run code on the machine. A different CVE, CVE-2026-42271, affected the preview of MCP and was already observed in actual holdings and listed in the CSA cataloguing for actively exploited vulnerabilities; it is worth consulting in the known CSA catalogue: CISA KEV.

What should those responsible for below and security do right now? The answer starts with the update: parking at v1.83.14-stable or higher immediately. After applying the correction, it is not enough to close the hole: it must be assumed that any committed instance could have had access to keys and data in transit, so the following action is an audit and rotation of secrets.

Audit and treat the proxy _ admin role as host level access: revalue each account with that role, close obsolete accounts and require strong and just-in-time authentication wherever possible. Check all Custom Code Guards and look for suspicious payloads; remember that the callbacks declared in configuration (e.g. litellm _ settings.callbacks) do not appear on the console and are a logical place where a post-exploitation attacker would hide persistence or traps. Also check the integrity of the code displayed in front of the source in Git and signed release hashes: do not trust only the configuration.

If you suspect commitment, immediately rotate all supplier keys (OpenAI, Anthropic, Gemini, Bedrock, Azure, etc.), change the salt and database credentials and MCP tokens; consider that the keys in configuration files or environment variables could have been read in clear text. Activate detection of log and traffic anomalies: peaks of requests to administrative endpoints, changes in user fields, creation of virtual keys with large _ routs or new callbacks are commitment indicators.

In the operational and medium-term architecture, rethink the location of this type of critical gateway and its confidence model: minimize the amount of sensitive data that pass through a single point, segregate networks and roles, use external and encrypted secret managers with separation of functions so that the gateway does not have direct access to master keys are measures that reduce the blast radius. Also, code execution rules (guarrails) should be designed with default security models, bytecode-level filters and not just regex, and avoid direct exec () with incomplete globals.

It is also time to review the supply chain and the update process: LiteLLM already suffered backdoor attempts in PyPI in March and an SQL injection exploded in April, which shows that IA infrastructure projects are attractive targets. Sign and verify tarbals and packages, apply unit scans and use version blocking policies in productive environments.

For teams operating agents or model gateways, this incident must change the threat matrix: a committed gateway not only filters data, can alter the very logic that rules the agents. Consider final controls in the endpoint that validate the integrity of the responses before implementing critical actions, and maintain a clear separation between sensitive data and prompts that access productive systems.

In short: update the parched version, audit roles and callbacks, record secrets if there was exposure and reevaluate the trusted architecture that puts a single service at the center of the IA traffic. The failure is not only technical: it is an operational lesson about how we design and defend the doors that mediate between humans, agents and models.