Unverified50% confidenceFactExact time

LiteLLM has a vulnerability GHSA-7hp6-4w63-5g45 with no assigned CVE ID (CVSS 9.9), affecting versions 1.91.0 to 1.100.4 as well as 1.101.0-1.101.2, 1.102.0-1.102.1, and 1.103.0, where any user with the internal_user role can escalate themselves to proxy administrator.

1

Sources

50%

Confidence

Medium-term (~90 days)

Relevance

10/13/2026

First Seen

Valid until: 1/11/2027

Sources

Self-Hosted LiteLLM Security Hardening Checklist: Your Master Key Is the Admin Password

Related Entities

LiteLLMproduct GHSA-7hp6-4w63-5g45concept

Related Claims

VerifiedVersion v0.29.1rc0 was tagged by maintainer TQCB and verified via GitHub with a GPG key ID of B5690EEEBB952194.60% similar UnverifiedThe release artifacts of langchain-core 1.6.5 are verified through a GitHub verified signature (GPG Key ID: B5690EEEBB952194).58% similar Unverifiedv1.4.0 refreshes the platform model IDs in the example code.57% similar UnverifiedCVE-2025-66208 is an operating system command injection vulnerability in richdocumentscode (the Collabora/CODE online document editing component) built into Nextcloud.55% similar UnverifiedVersion v0.35.0-rc0 added the System One scoring API (corresponding to PR #18606).54% similar

Cite This Claim

Stable URI

https://kongchang.com/claim/1017237

API

curl https://kongchang.com/api/v1/knowledge/claims/1017237

MCP

get_claim(id=1017237)