Is litellm safe?
31 fixed advisories Facts from the mcp-audit registry about the pypi package litellm. The same data is served as JSON.
Check it from your terminal
mcp-audit vet litellm --ecosystem pypiOffline: it uses the registry bundled with mcp-audit. mcp-audit update-registry fetches the newest one.
Registry facts
| Maintainer | BerriAI |
|---|---|
| Verified publisher | no |
| Entry last checked | 2026-10-29 |
| Hash pins | none recorded |
| Provenance expected | no |
| Repository | https://github.com/BerriAI/litellm |
Recorded advisories 31
| Advisory | CVSS | Summary | Fixed in |
|---|---|---|---|
| CVE-2024-10188 | not recorded | LiteLLM Vulnerable to Denial of Service (DoS) | 1.53.1.dev1 |
| CVE-2024-2952 | not recorded | LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint | 1.34.42 |
| CVE-2024-4888 | not recorded | Arbitrary file deletion in litellm | 1.35.36 |
| CVE-2024-5225 | not recorded | SQL injection in litellm | 1.40.0 |
| CVE-2024-5710 | not recorded | litellm vulnerable to improper access control in team management | 1.40.15 |
| CVE-2024-5751 | not recorded | litellm vulnerable to remote code execution based on using eval unsafely | 1.40.16 |
| CVE-2024-6587 | not recorded | LiteLLM Server-Side Request Forgery (SSRF) vulnerability | 1.44.8 |
| CVE-2024-8984 | not recorded | LiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP Request | 1.56.2 |
| CVE-2024-9606 | not recorded | LiteLLM Reveals Portion of API Key via a Logging File | 1.44.12 |
| CVE-2025-0628 | not recorded | LiteLLM Has an Improper Authorization Vulnerability | 1.61.15 |
| CVE-2026-114612 | not recorded | LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key | 1.104.0rc2 |
| CVE-2026-12773 | not recorded | LiteLLM: MCP Proxy Has Improper Authentication | 1.84.0 |
| CVE-2026-35029 | not recorded | LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint | 1.83.0 |
| CVE-2026-35030 | not recorded | LiteLLM: Authentication bypass via OIDC userinfo cache key collision | 1.83.0 |
| CVE-2026-37004 | not recorded | LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint | 1.83.7 |
| CVE-2026-40217 | not recorded | LiteLLM has a sandbox escape in custom-code guardrail | 1.83.10 |
| CVE-2026-42203 | not recorded | LiteLLM: Server-Side Template Injection in /prompts/test endpoint | 1.83.7 |
| CVE-2026-42208 | not recorded | LiteLLM has SQL Injection in Proxy API key verification | 1.83.7 |
| CVE-2026-42271 | not recorded | LiteLLM: Authenticated command execution via MCP stdio test endpoints | 1.83.7 |
| CVE-2026-47101 | not recorded | LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit | 1.83.14 |
| CVE-2026-47102 | not recorded | LiteLLM allows a user to modify their own user_role via the /user/update endpoint | 1.83.10 |
| CVE-2026-49468 | not recorded | LiteLLM: Authentication Bypass via Host Header Injection | 1.84.0 |
| CVE-2026-59819 | not recorded | LiteLLM: Local file read via request-supplied OIDC file references | 1.83.10 |
| CVE-2026-59820 | not recorded | LiteLLM: Arbitrary file write via path traversal in Skills archive extraction | 1.83.7 |
| CVE-2026-59821 | not recorded | LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks | 1.82.0 |
| CVE-2026-59822 | not recorded | LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback | 1.84.0 |
| CVE-2026-59823 | not recorded | LiteLLM Proxy has server-side request forgery via the `user_config` request parameter | 1.83.9 |
| CVE-2026-84377 | not recorded | LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters | 1.96.2 |
| GHSA-69x8-hrgq-fjj8 | not recorded | LiteLLM: Password hash exposure and pass-the-hash authentication bypass | 1.83.0 |
| GHSA-g5ff-637f-6q2m | not recorded | LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials` | 1.95.0 |
| GHSA-hhww-mrg2-969h | not recorded | LiteLLM vulnerable to reflected XSS in /sso/debug/callback | 1.85.0 |
Advisories with no recorded fix are listed first. CVE IDs link to NVD, GHSA IDs to GitHub and other IDs to OSV. A fixed advisory affects only versions below its fix; vet exits 1 only for advisories with no fix.
What it can do
- It can make outbound network requests.
Capability tags come from the registry. mcp-audit uses them to find dangerous combinations with your other servers.
Check how you run it
This page describes the public package. What matters is your setup: which version you pin, which secrets you pass, and which other servers sit next to it.
mcp-audit checkBadge for your README
mcp-audit31 fixed CVEs
Preview drawn by this page. The real badge is rendered by shields.io from this JSON and updates when the registry does.
[](https://mcp-audit.dev/servers/pypi/litellm/)