Pin the LiteLLM image by digest to a supported minor line, find every place LiteLLM arrives as a dependency, and keep the proxy and its admin routes off the public internet. The gateway holds every provider credential your company uses, and GitHub lists 44 reviewed advisories for it as of October 28, 2026, three of them on CISA's list of exploited vulnerabilities. This checklist covers installation, the support window, advisories, the master key, network access and logs.
When you need this
Evaluation criteria
Install from a pinned, verified source
Can a poisoned release reach you?
Look forOn March 24, 2026, litellm 1.82.7 and 1.82.8 on PyPI carried a credential stealer after attackers took a publishing token through a compromised Trivy scanner in BerriAI's CI. The official Docker image was not affected in March. On October 21, 2026, attackers with stolen maintainer tokens ran BerriAI's own release pipeline. It signed and published malicious 1.107.0 to PyPI and to the v1.107.0, latest, main-latest, and main-stable Docker tags. Pin 1.106.5 or another release with the GHSA-w4c7 fix by hash or digest, and use no floating tags. Check that provenance names BerriAI/litellm as the source repository, since October's build came from a lookalike fork. Add a dependency cooldown such as uv's exclude-newer, which engineers adopted after the March incident.
Find transitive installs
Where does LiteLLM run without anyone choosing it?
Look forFutureSearch was hit when an MCP server pulled the latest LiteLLM inside Cursor, and Comet traced exposure through the pip logs of more than 50 repositories' CI runs. Inventory every environment, CI image, and agent tool that installs LiteLLM, and pin it there too.
Stay inside the support window
Will your version receive the next patch?
Look forLiteLLM supports its four most recent stable minor lines, about four weeks of releases, and BerriAI states that a fix for a high-severity problem outside the window is rare. Enterprise customers get notice of large security updates 7 days before public disclosure.
Watch the advisories
How do you learn about a fix?
Look forSubscribe to the repository's GitHub security advisories. Since September 2026, BerriAI builds fixes for unauthenticated issues in a private fork and publishes the release, backports, and disclosure together. CISA added CVE-2026-42208 (SQL injection in API key verification), CVE-2026-42271 (command execution through MCP test endpoints), and CVE-2026-59822 (MCP authentication bypass) to its exploited list in 2026.
Lock down the master key
Is the admin credential strong and private?
Look forBerriAI reports that Wiz found 1 in 10 scanned LiteLLM instances running with a blank or default master key. Current releases refuse to start that way. Keep the master key in a secret manager, give clients virtual keys only, and set trusted proxy ranges so admin sign-in limits work behind a load balancer.
Limit what is reachable
Who can reach the proxy and its admin routes?
Look forSeveral 2026 advisories needed only network access to the proxy, including a Host header bypass of authentication fixed in v1.84.0. Keep the gateway off the public internet where possible, restrict admin routes, and restrict MCP server creation to administrators.
Keep secrets out of logs
What do logs and traces carry?
Look forA March 2026 incident showed custom guardrail logging writing plaintext Authorization headers into spend logs and traces. turn_off_message_logging drops message bodies. Check which user and key identifiers your spans still carry, and allow-list span attributes before sending traces to a third party.
Questions to ask vendors
- Which LiteLLM version runs in each environment, and is each inside the four-line window?
- Where does LiteLLM arrive as a transitive dependency, and is it pinned there?
- Who watches GitHub security advisories and CISA's exploited list for LiteLLM?
- Can anyone outside our network reach the proxy or its admin routes?
- What do our traces and spend logs record about users and keys?
Red flags
- pip install litellm without a version in any build or agent tool.
- A LiteLLM container on a floating tag such as latest or main-stable, or pinned by tag with no digest.
- A proxy reachable from the internet on a version older than the latest advisory fix.
- A blank, default, or shared master key.
- Traces exported to a third party with every default span attribute.
Products in this piece
Sources
- Official documentation
- 12
- Public source
- 7
- LiteLLM blog: Security update, suspected supply chain incident (Mar 24, 2026)
- LiteLLM blog: LiteLLM release v1.107.0 compromised (Oct 21, 2026)
- LiteLLM blog: The attack chain behind the v1.107.0 LiteLLM release (Oct 23, 2026)
- LiteLLM blog: Announcing CI/CD v2 for LiteLLM (Mar 30, 2026)
- LiteLLM docs: Docker image security
- LiteLLM docs: Version support
- LiteLLM docs: Compliance and SOC 2 Type II
- LiteLLM blog: September townhall updates (Sep 24, 2026)
- LiteLLM blog: Vulnerability disclosures and ongoing hardening (Apr 3, 2026)
- LiteLLM blog: Authentication bypass via Host header injection (Jun 1, 2026)
- LiteLLM blog: Incident report, guardrail logging exposed secret headers (Mar 18, 2026)
- LiteLLM docs: Production best practices
- GitHub Advisory Database: GHSA-5mg7-485q-xm76, two LiteLLM versions published with credential-harvesting malware (Mar 25, 2026)
- BerriAI/litellm advisory GHSA-w4c7-34wj-hqm8: unauthenticated file read leaks master key on Enterprise proxy, patched in 1.106.5 (Oct 27, 2026)
- CISA Known Exploited Vulnerabilities Catalog, version 2026.10.08 (Oct 8, 2026)
- Callum McMahon, FutureSearch blog: litellm 1.82.8 supply chain attack on PyPI (Mar 24, 2026)
- FutureSearch: company page listing Jack Wildman as Senior Software Engineer and Callum McMahon as Research Scientist (Oct 30, 2026)
- Nimrod Lahav, Comet blog: LiteLLM supply chain attack and how Comet responded (Mar 24, 2026)
- Dan O'Leary, Antisimplistic: uv settings changed after LiteLLM (Mar 28, 2026)