Key findings
- The advisories break down as 7 critical, 19 high, 9 medium, and 9 low, excluding one duplicate, and 40 carry CVE IDs.
- GitHub published 30 of the advisories in 2026, three of them on October 27. The March compromise brought audits, a bug bounty and outside researchers to the code.
- The March malicious releases, 1.82.7 and 1.82.8, went to PyPI on March 24, 2026, and the official Docker image was not affected in March.
- On October 21, 2026, BerriAI's own pipeline signed and published malicious 1.107.0 to PyPI and to four official Docker tags. Version 1.106.5 is free of both payloads and carries the fix for the critical October 27 advisory GHSA-w4c7.
- The exploited CVEs are CVE-2026-42208, CVE-2026-42271, and CVE-2026-59822.
- BerriAI signs Docker images and publishes to PyPI through Trusted Publishing, and the October release still went out signed because attackers ran that pipeline. The proxy refuses to start with a blank or default master key.
Most of LiteLLM's 2026 advisories hit the proxy's login and admin routes, so run it like any internet-facing service that holds your provider keys and prompts. Keep the admin routes private and set a real master key before anyone connects. The counts below are GitHub's reviewed list as of October 28, 2026.
The advisory count
GitHub's Advisory Database lists 44 reviewed advisories affecting the litellm package on PyPI as of October 28, 2026, excluding one marked as a duplicate. The 2024 entries include server-side template injection, unsafe eval leading to remote code execution, SQL injection, arbitrary file deletion, and server-side request forgery. The six published in March 2025 cover denial of service, a remote code execution, API keys exposed through logs, and improper authorization.
Most of the 2026 entries concern the proxy's authentication and administration. They include an authentication bypass when JWT auth is on, privilege escalation through a configuration endpoint, password hash exposure, and SQL injection in API key verification. Others are server-side template injection in a prompt test endpoint, command execution through MCP test endpoints, and a sandbox escape in custom-code guardrails. A Host header bypass also defeats authentication. Nine are rated low.
| Year | Advisories | Severity mix |
|---|---|---|
| 2024 | 8 | 2 critical, 3 high, 3 medium |
| 2025 | 6 | 6 high, all published in March 2025 |
| 2026 | 30 | 5 critical, 10 high, 6 medium, 9 low |
GitHub Advisory Database, query for the litellm PyPI package, checked Oct 28, 2026; one duplicate advisory excluded
The March 2026 compromise
BerriAI traces the compromise to the Trivy scanner in its CI pipeline, through which attackers obtained publishing credentials. Versions 1.82.7 and 1.82.8 went to PyPI on March 24, 2026, outside BerriAI's release workflow. 1.82.7 carried the payload in the proxy server, and 1.82.8 added a .pth file that runs on every Python start. BerriAI states the packages were live from 10:39 UTC for about 40 minutes before PyPI quarantined them, and lists pip installs between 10:39 and 16:00 UTC that day as possibly affected.
The payload collected environment variables, SSH keys, cloud and Kubernetes credentials, and database passwords and sent them to a lookalike domain. The official Docker image pins its dependencies, so its users were not affected in March. Accounts from FutureSearch and Comet show how the payload arrived, through an MCP server pulled into Cursor without a pinned version and through CI workflows that installed the latest release.
The October 2026 compromise
On October 21, 2026, attackers used stolen maintainer tokens to approve a run of BerriAI's own release pipeline, built from a lookalike fork. It signed and published litellm 1.107.0. Seven PyPI wheels were live from 11:39 UTC until PyPI froze them at 13:23 UTC.
The Docker tags v1.107.0, latest, main-latest, and main-stable served the malicious image from 11:46 UTC until 14:20 UTC. BerriAI traces the access to an Agent Platform master key committed to a public repository on May 27, 2026 and never revoked. The payload ran at every Python start and stole credentials.
Every version except 1.82.7, 1.82.8, and 1.107.0 is free of the malware. Pin 1.106.5, which also fixes the critical October 27 advisory GHSA-w4c7, or another release with that fix, by hash or digest.
Exploited in the wild
CISA adds a CVE to its Known Exploited Vulnerabilities Catalog only when it has evidence of active exploitation. Version 2026.10.08 of the catalog lists three LiteLLM CVEs. CISA added CVE-2026-42208, SQL injection in the proxy's API key verification, on May 8, 2026. It added CVE-2026-42271, command execution through MCP test endpoints, on June 8, and CVE-2026-59822, an MCP authentication bypass, on September 2.
BerriAI's write-up of the SQL injection flaw states that versions 1.81.16 through 1.83.6 were affected and that an unauthenticated request could reach a vulnerable database query. It advises reviewing Postgres query history for proxies reachable from untrusted networks.
What BerriAI changed
After the March incident BerriAI moved releases to a CI/CD v2 pipeline with isolated scanning and separate validation and release repositories. It added Trusted Publishing to PyPI, immutable Docker tags, and cosign signatures on every GHCR image from v1.83.0. It brought in Veria Labs to audit the proxy, launched a bug bounty, and recertified SOC 2 Type 2 with Vanta, publishing the updated report on September 8, 2026.
In September 2026 BerriAI reported 52 security fixes in a month. It began building fixes for unauthenticated issues in a private fork and publishing them with the release. It also added a startup check after Wiz found 1 in 10 scanned instances with a blank or default master key. BerriAI attributes the rising CVE count to a change in publishing policy and states that its security has not gotten worse.
What a buyer should take from it
Patch LiteLLM within its support window, keep it unreachable from untrusted networks, and install it only from pinned, verified artifacts.
- Pin the Docker image by digest to a supported minor line with the GHSA-w4c7 fix, such as 1.106.5, and use no floating tags.
- Check that each image's provenance names BerriAI/litellm as its source repository, since a valid signature passed October's malicious images.
- Track GitHub security advisories and CISA's exploited list for LiteLLM.
- Keep the proxy and its admin routes off the public internet.
- Pin LiteLLM wherever it arrives as a library, including agent tools and MCP servers.
Methodology
GILD counted the GitHub Advisory Database entries for the litellm PyPI package through GitHub's advisories API on October 28, 2026, and excluded one entry labeled as a duplicate. The year is the advisory's publication date in that database. CISA entries come from the Known Exploited Vulnerabilities Catalog, version 2026.10.08. Incident details come from BerriAI's own posts, the GitHub advisory, and public write-ups by FutureSearch and Comet, each opened on October 12, 2026. GILD opened BerriAI's two October 2026 incident posts and advisory GHSA-w4c7 on October 28, 2026.
Products in this piece
Sources
- Public source
- 6
- Official documentation
- 10
- GitHub Advisory Database: reviewed advisories for litellm on PyPI (as of Oct 28, 2026)
- GitHub Advisory Database: GHSA-5mg7-485q-xm76, two LiteLLM versions published with credential-harvesting malware (Mar 25, 2026)
- BerriAI/litellm advisory GHSA-w4c7-34wj-hqm8: unauthenticated file read leaks master key on Enterprise proxy, patched in 1.106.5 (Oct 27, 2026)
- CISA Known Exploited Vulnerabilities Catalog, version 2026.10.08 (Oct 8, 2026)
- Callum McMahon, FutureSearch blog: litellm 1.82.8 supply chain attack on PyPI (Mar 24, 2026)
- Nimrod Lahav, Comet blog: LiteLLM supply chain attack and how Comet responded (Mar 24, 2026)
- LiteLLM blog: Security update, suspected supply chain incident (Mar 24, 2026)
- LiteLLM blog: LiteLLM release v1.107.0 compromised (Oct 21, 2026)
- LiteLLM blog: The attack chain behind the v1.107.0 LiteLLM release (Oct 23, 2026)
- LiteLLM blog: Announcing CI/CD v2 for LiteLLM (Mar 30, 2026)
- LiteLLM blog: Vulnerability disclosures and ongoing hardening (Apr 3, 2026)
- LiteLLM blog: CVE-2026-42208 in LiteLLM Proxy (Apr 29, 2026)
- LiteLLM blog: Authentication bypass via Host header injection (Jun 1, 2026)
- LiteLLM blog: Updated SOC 2 Type 2 report (Sep 8, 2026)
- LiteLLM blog: September townhall updates (Sep 24, 2026)
- LiteLLM docs: Docker image security