by Kastro CVE-2026-49468
BerriAI litellm — LiteLLM: Authentication Bypass via Host Header Injection
Description · from the CVE record
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, a Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes. The auth layer derived the effective route from request.url.path in litellm/proxy/auth/auth_utils.py::get_request_route(), which Starlette reconstructs from the Host header. A crafted Host could therefore make the auth gate evaluate a different route from the one FastAPI dispatched. This vulnerability is fixed in 1.84.0.
Affected
ProductAffectedFixed inSource
litellm< 1.84.0–CNA
Exploit Intelligencesee advisory–redhat-SADP
Red Hat Ansible Automation Platform 2see advisory–redhat-SADP
Red Hat Ansible Automation Platform 2see advisory–redhat-SADP
Red Hat OpenShift AI (RHOAI)see advisory–redhat-SADP
Red Hat OpenShift AI (RHOAI)see advisory–redhat-SADP
Red Hat OpenShift AI (RHOAI)see advisory–redhat-SADP
Scores by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)9.5CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
redhat-SADP (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total