CVE-2026-49468

Summary

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, This vulnerability is fixed in 1.84.0.

Affected Software

Weaknesses

• CWE-290: CWE-290: Authentication Bypass by Spoofing

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: total

litellm: LiteLLM: Authentication Bypass via Host Header Injection

Additional References

• https://access.redhat.com/security/cve/CVE-2026-49468
• https://bugzilla.redhat.com/show_bug.cgi?id=2491520
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49468.json

References

• https://github.com/BerriAI/litellm/security/advisories/GHSA-4xpc-pv4p-pm3w
• https://github.com/BerriAI/litellm/releases/tag/v1.84.0

• ←Previous
• Next→