CVE-2026-47101

Executive Summary

CVE-2026-47101 is a critical privilege escalation vulnerability in LiteLLM, an open-source proxy server for managing access to various Large Language Model (LLM) APIs. The flaw resides in the API key generation mechanism, where the allowed_routes field is not validated against the requesting user's own permissions. An authenticated user with the internal_user role can create API keys that grant access to routes reserved for the proxy_admin role. This allows the attacker to bypass Role-Based Access Controls (RBAC) and perform administrative actions, leading to full privilege escalation.

The vulnerability has a CVSS score of 8.8 (High) and affects all versions prior to 1.83.14. The EPSS score is 0.0%, indicating no active exploitation in the wild at the time of analysis, but the technical impact is severe. No public proof-of-concept (PoC) or exploit code has been released.

Supply Chain & Package Security

LiteLLM is distributed as a Python package via PyPI (litellm). Organizations using this package should verify their dependency version and ensure it is updated to 1.83.14 or later. The vulnerability is introduced in the source code and is not a result of a compromised dependency, but the package itself is the attack vector. Users should also verify the integrity of the package using checksums provided by the maintainers.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs a valid internal_user account.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full access to all data managed by the proxy.
• Integrity (I): High (H) – Ability to modify configurations and API keys.
• Availability (A): High (H) – Potential to disrupt service or delete resources.

Threat Level: Critical. The low privileges required and high impact make this a prime target for internal attackers or attackers who have compromised a low-privilege account.

Deep Dive & Mechanics

The vulnerability is rooted in the API endpoint used to generate new API keys. In LiteLLM, users with the internal_user role are permitted to create keys for themselves or other users, but they should only be able to assign routes that are within their own permission scope. The proxy_admin role has access to administrative routes (e.g., /key/generate, /model/new, /config/update).

The flawed logic occurs in the key generation handler. When a request is made to create a key, the allowed_routes parameter is accepted and stored directly into the database without verifying that the requesting user has permission to access those routes. The code likely performs a check on the user's role but fails to validate the routes against the user's allowed routes list.

Attack Flow:

1. An attacker authenticates as an internal_user (e.g., via stolen credentials or a legitimate account).
2. The attacker sends a POST request to the key generation endpoint (e.g., /key/generate) with a crafted payload that includes allowed_routes: ["admin_route_1", "admin_route_2"].
3. The server creates a new API key with those routes stored in the database.
4. The attacker uses the new key to access admin-only endpoints, effectively escalating privileges to proxy_admin.

The vulnerability is a classic case of Missing Authorization (CWE-862). The server trusts the client-provided allowed_routes without cross-referencing the user's own permissions.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 1.83.14):

# Hypothetical vulnerable code snippet
def generate_key(user, allowed_routes):
    # No validation of allowed_routes against user's permissions
    key = create_api_key(allowed_routes=allowed_routes)
    return key

Patched Code (1.83.14+):

# Hypothetical patched code snippet
def generate_key(user, allowed_routes):
    # Validate that each route in allowed_routes is within user's permitted routes
    user_permitted_routes = get_user_permitted_routes(user)
    for route in allowed_routes:
        if route not in user_permitted_routes:
            raise PermissionError("Route not allowed for this user")
    key = create_api_key(allowed_routes=allowed_routes)
    return key

The patch adds a validation step that checks each requested route against the user's own permitted routes before creating the key.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Access to a LiteLLM instance (version < 1.83.14)
• Valid credentials for an internal_user account

Exploitation Steps:

1. Authenticate and obtain a session token.

   curl -X POST https://target.litellm.com/login \
     -H "Content-Type: application/json" \
     -d '{"username": "attacker", "password": "password123"}'
   

2. Create a new API key with admin routes.

   curl -X POST https://target.litellm.com/key/generate \
     -H "Authorization: Bearer <session_token>" \
     -H "Content-Type: application/json" \
     -d '{
       "allowed_routes": ["/key/generate", "/model/new", "/config/update"],
       "key_alias": "escalated_key"
     }'
   

3. Use the new key to access an admin endpoint.

   curl -X GET https://target.litellm.com/config/update \
     -H "Authorization: Bearer <new_api_key>"
   

Expected Outcome: The attacker gains full administrative control over the LiteLLM proxy.

Blue Team (Defender)

Detection Steps:

1. Monitor API key creation logs for anomalies, especially keys created by internal_user accounts that have routes typically reserved for proxy_admin.
2. Audit user permissions regularly to ensure no internal_user has been granted admin routes.
3. Implement network segmentation to limit access to the LiteLLM admin interface.
4. Enable logging of all API key usage and alert on access to admin routes by non-admin keys.

Honeypot Strategy:

• Create a fake admin route that logs access attempts and triggers an alert.

Indicators of Compromise (IOCs)

• Log Entries:
  • API key creation events where allowed_routes contains admin routes (e.g., /key/generate, /model/new, /config/update) and the creator role is internal_user.
  • Successful access to admin endpoints using an API key that was not created by a proxy_admin.
• Network Traffic:
  • POST requests to /key/generate with a JSON body containing allowed_routes with admin routes.
  • GET/POST requests to admin endpoints (e.g., /config/update) from unexpected API keys.
• File System:
  • Modified configuration files (e.g., proxy_config.yaml) if the attacker used the escalated key to change settings.

Detection Engineering

YARA Rule

rule CVE_2026_47101_LiteLLM_PrivEsc {
    meta:
        description = "Detects exploitation attempts of CVE-2026-47101 in LiteLLM logs"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-47101"
    strings:
        $s1 = "/key/generate" ascii wide nocase
        $s2 = "allowed_routes" ascii wide nocase
        $s3 = "internal_user" ascii wide nocase
        $s4 = "proxy_admin" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3) or (all of ($s1, $s2, $s4))
}

Sigma Rule

title: CVE-2026-47101 - LiteLLM Privilege Escalation via API Key Generation
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects API key creation with admin routes by internal_user
author: Valters IT
date: 2026-01-01
logsource:
    category: application
    product: litellm
detection:
    selection:
        event: "key_generated"
        creator_role: "internal_user"
        allowed_routes|contains: 
            - "/key/generate"
            - "/model/new"
            - "/config/update"
    condition: selection
falsepositives:
    - Legitimate admin creating keys for internal users (should be rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-47101 - LiteLLM Privilege Escalation Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/key/generate"; http_uri;
    content:"allowed_routes"; http_client_body;
    content:"/key/generate"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2026-47101;
    classtype:attempted-admin;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade LiteLLM to version 1.83.14 or later. This is the only complete fix.
2. If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block API key creation requests where allowed_routes contains admin routes from non-admin users.
3. Review and rotate all existing API keys, especially those created by internal_user accounts.
4. Audit user roles and ensure no internal_user has been inadvertently granted admin permissions.

Long-term Mitigations:

• Implement strict RBAC with least privilege principles.
• Enable comprehensive logging and monitoring for all API key operations.
• Conduct regular security audits of the LiteLLM configuration.
• Use a secrets management solution to store and rotate API keys.

Workaround (if patching is delayed):

• Disable the API key generation endpoint for internal_user roles by modifying the proxy configuration or using a reverse proxy to restrict access.

Valters IT