psf-litellm-escalation-check(8)

Script: /opt/psf-security-patches/litellm/litellm-escalation-check.sh. Tool page: LiteLLM. Source. With the package installed: man psf-litellm-escalation-check.

LiteLLM proxy admin escalation: read-only checker  (v1)
CVE-2026-114612 (CVSS 9.9, GHSA-7hp6-4w63-5g45)

If this software is helpful, consider a donation to our 501c3 nonprofit:
https://privacysafe.foundation

The LiteLLM proxy uses one cryptographic context for two purposes: sealing secrets
at rest and minting session tokens. An authenticated user with internal_user
privileges can request a new API key with a crafted metadata field that holds a forged
administrator credential as the "secret"; the proxy encrypts it and returns it, and the
user replays it as a bearer token to become proxy_admin, which reaches arbitrary
commands through the MCP stdio endpoint.

  Affected (CVE record): 1.87.0 up to 1.100.4, 1.101.0 up to 1.101.3, 1.102.0 up to
            1.102.2, 1.103.0 up to 1.103.1, and 1.104.0-rc.1 up to 1.104.0-rc.2
  Fixed:    1.100.4, 1.101.3, 1.102.2, 1.103.1 and 1.104.0-rc.2 (all on PyPI), and
            every later release. move 1.87.0 through 1.99.x to 1.100.4 or newer.
  Note:     The vendor advisory lists 1.91.0 as the first exploitable version; a
            third-party reading says 1.87.0 to 1.90.x need EXPERIMENTAL_UI_LOGIN and
            1.91.0 and later are exploitable by default. This script treats the whole
            CVE range as affected.

It is the PROXY that is affected. Using litellm only as a Python library (the SDK), with
no proxy running, does not expose it; this script says which it found evidence of.

DO NOT CONFUSE THIS WITH THE MALICIOUS RELEASE. litellm 1.107.0 is a different problem
(a supply-chain compromise, see litellm-oct2026-check.sh in this folder). If this script
meets 1.107.0 it says so and stops: treat that host as compromised.

This script is read-only. It finds installed copies (dist-info), pinned versions
(requirements, poetry.lock, uv.lock, pdm.lock, Pipfile.lock), and container image tags
in compose, Helm and Kubernetes files, and looks for proxy evidence. It does not open
running containers.

Usage:
  ./litellm-escalation-check.sh [command] [DIR ...]

  check (default)  scan DIR (default /usr/lib /usr/local/lib /opt /srv /var/lib /etc
                   /home /root). Exit 0 = nothing exposed, 1 = an affected proxy, a
                   floating image tag, or the malicious 1.107.0.
  version          print the script version.
Containers: with no argument the check also looks in running docker and podman containers
(SCAN_CONTAINERS=1, the default; 0 skips them). A read-only probe copies what this check reads
(the package metadata, the lock and requirements files that mention litellm, a one-line marker for
each proxy config, and only the matched image-tag strings) into a private temporary directory,
and this script runs once per container in isolation against that copy. API keys, master keys
and index credentials never leave the container. Paths shown as .../docker_NAME/... are inside
the container NAME.

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.