litellm
v1.108.9The fastest, litest AI Gateway. Rust core with Python SDK. Call 100+ LLM APIs in OpenAI (or native) format with cost tracking, guardrails, load balancing, and logging [Bedrock, Azure, OpenAI, Anthropic, OpenAI, VertexAI, vLLM, Nvidia NIM]
- Maintenance
- Active16222 commits in 3 months · bus factor 2
- License
- OtherUnknown
- Security
- 19 advisories5 critical, 7 high, 5 medium, 2 low · Scorecard 5.8/10
- Supported versions
- No scheduleendoflife.date does not track this project
63.3k stars · 13.3k forks · 5.2k open issues · last release 15 hours ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 19 most recent advisories published by the maintainers: 5 critical, 7 high, 5 medium, 2 low. Check the patched version against the one you run.
- highGHSA-2rwg-2wh4-7c4fNov 12, 2026Authenticated secret exfiltration via Azure Entra credential parameters in the request body
- Affected
- < 1.106.9; < 1.108.6; < 1.109.1; < 1.110.0-rc.2
- Patched in
- 1.106.9; 1.108.6; 1.109.1; 1.110.0-rc.2
- criticalGHSA-w4c7-34wj-hqm8Oct 27, 2026Unauthenticated file read leaks master key on Enterprise proxy
- Affected
- < 1.103.10; < 1.104.8; < 1.105.6; < 1.106.5
- Patched in
- 1.103.10; 1.104.8; 1.105.6; 1.106.5
- highGHSA-g5ff-637f-6q2mOct 1, 2026internal_user_viewer arbitrary local file read via `vertex_ai_credentials`
- Affected
- <1.95.0
- Patched in
- 1.95.0
- mediumGHSA-hhww-mrg2-969hSep 30, 2026Reflected XSS in /sso/debug/callback
- Affected
- >= 1.65.5, < 1.85.0
- Patched in
- 1.85.0
- criticalCVE-2026-114612Sep 30, 2026Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
- Affected
- >= 1.91.0, < 1.100.4; >= 1.101.0, < 1.101.3; >= 1.102.0, < 1.102.2; >= 1.103.0, <1.103.1; >= 1.104.0rc1, < 1.104.0rc2
- Patched in
- 1.100.4; 1.101.3; 1.102.2; 1.103.1; 1.104.0rc2
- mediumCVE-2026-84377Aug 26, 2026Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters
- Affected
- <1.94.0
- Patched in
- 1.96.2, 1.95.1, 1.94.3, 1.93.2, 1.92.2, 1.91.5, 1.90.7, 1.89.7, 1.88.6
- mediumCVE-2026-59823Aug 26, 2026Server-side request forgery via the `user_config` request parameter in LiteLLM Proxy
- Affected
- <=1.83.8
- Patched in
- 1.83.9
- lowCVE-2026-59821Jun 30, 2026Custom Code Guardrails production endpoints bypass code safety checks
- Affected
- < 1.82.0-stable
- Patched in
- >= 1.82.0-stable
- highCVE-2026-59822Jun 30, 2026MCP Authentication Bypass via OAuth2 Passthrough Fallback
- Affected
- < 1.84.0
- Patched in
- >= 1.84.0
- lowCVE-2026-59819Jun 30, 2026Local file read via request-supplied OIDC file references
- Affected
- < 1.83.10-stable
- Patched in
- >= 1.83.10-stable
- mediumCVE-2026-59820Jun 30, 2026Arbitrary file write via path traversal in Skills archive extraction
- Affected
- < 1.83.7-stable
- Patched in
- >= 1.83.7-stable
- criticalCVE-2026-49468May 28, 2026Authentication Bypass via Host Header Injection
- Affected
- <1.84.0
- Patched in
- >=1.84.0
- mediumCVE-2026-40217May 7, 2026Sandbox escape in custom-code guardrail
- Affected
- >= 1.81.8, < 1.83.10
- Patched in
- >= 1.83.10
- highCVE-2026-42271Apr 21, 2026Authenticated command execution via MCP stdio test endpoints
- Affected
- >=1.74.2, <1.83.7
- Patched in
- >=1.83.7
- criticalCVE-2026-42208Apr 20, 2026SQL injection in Proxy API key verification
- Affected
- >=1.81.16, <1.83.7
- Patched in
- >=1.83.7
- highCVE-2026-42203Apr 20, 2026Server-Side Template Injection in /prompts/test endpoint
- Affected
- >= 1.80.5, < 1.83.7
- Patched in
- >= 1.83.7
- highGHSA-69x8-hrgq-fjj8Apr 4, 2026Password hash exposure and pass-the-hash authentication bypass
- Affected
- <1.83.0
- Patched in
- 1.83.0
- highCVE-2026-35029Apr 3, 2026Privilege escalation via unrestricted proxy configuration endpoint
- Affected
- <1.83.0
- Patched in
- 1.83.0
- criticalCVE-2026-35030Apr 3, 2026Authentication bypass via OIDC userinfo cache key collision
- Affected
- <1.83.0
- Patched in
- 1.83.0