CVE-2026-47102

Executive Summary

CVE-2026-47102 is a critical privilege escalation vulnerability in LiteLLM, an open-source proxy server for managing access to various Large Language Models (LLMs). The flaw resides in the /user/update endpoint, which allows authenticated users to modify their own account details. However, the endpoint fails to restrict which fields can be changed, enabling a user to escalate their user_role to proxy_admin. This grants full administrative control over the LiteLLM instance, including access to all users, teams, API keys, models, and prompt history. The vulnerability is rated CVSS 8.8 (High) and is currently unpatched in versions prior to 1.83.10. No public proof-of-concept (PoC) or exploit code is available at this time, but the attack vector is straightforward and requires only low-privileged access.

Supply Chain & Package Security

LiteLLM is distributed as a Python package via PyPI (litellm). Organizations using this package should verify their installed version and update to 1.83.10 or later. The vulnerability is introduced in the application code, not in a dependency, but the supply chain risk is elevated due to the potential for a compromised LiteLLM instance to leak sensitive API keys and model access credentials.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The endpoint is accessible over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs a valid user account.
• User Interaction (UI): None (N) – No user action is needed.
• Scope (S): Unchanged (U) – The vulnerability does not cross a trust boundary.
• Confidentiality Impact (C): High (H) – Full access to all data, including API keys and prompt history.
• Integrity Impact (I): High (H) – Ability to modify any configuration or user data.
• Availability Impact (A): High (H) – Potential to disrupt service or delete resources.

Threat Level: Critical. The low barrier to entry (authenticated user) and high impact make this a priority for patching.

Deep Dive & Mechanics

The vulnerability exists in the /user/update endpoint, which is designed to allow users to update their own profile information. The endpoint correctly validates that the user can only modify their own account (by checking the user ID in the request against the authenticated user's ID). However, it does not validate or restrict the fields that can be updated. Specifically, the user_role field is not filtered out.

A typical request to /user/update might look like:

{
  "user_id": "user_abc123",
  "user_role": "proxy_admin"
}

The server processes this request and updates the user's role in the database without checking if the user is allowed to change their role. This allows any authenticated user to escalate to proxy_admin, which is the highest privilege level in LiteLLM.

The org_admin role has legitimate access to this endpoint and can exploit this vulnerability without any additional flaws, making it even more dangerous for organizations using role-based access control.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 1.83.10):

@app.route('/user/update', methods=['POST'])
def update_user():
    data = request.json
    user_id = data.get('user_id')
    # Only allow updating own account
    if user_id != current_user.id:
        return jsonify({"error": "Unauthorized"}), 403
    # Directly update all fields from request
    db.update_user(user_id, data)
    return jsonify({"success": True})

Patched Code (1.83.10+):

ALLOWED_FIELDS = ['display_name', 'email', 'metadata']

@app.route('/user/update', methods=['POST'])
def update_user():
    data = request.json
    user_id = data.get('user_id')
    if user_id != current_user.id:
        return jsonify({"error": "Unauthorized"}), 403
    # Filter to only allowed fields
    filtered_data = {k: v for k, v in data.items() if k in ALLOWED_FIELDS}
    db.update_user(user_id, filtered_data)
    return jsonify({"success": True})

The patch introduces an allowlist of fields that can be updated, preventing the user_role field from being modified.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid user account on a vulnerable LiteLLM instance (version < 1.83.10).
• Network access to the /user/update endpoint.

Exploitation Steps:

1. Authenticate to the LiteLLM instance and obtain a session token or API key.
2. Send a POST request to /user/update with the following payload:

   {
     "user_id": "<your_user_id>",
     "user_role": "proxy_admin"
   }
   

3. Confirm the role change by accessing an admin-only endpoint, such as /users/list or /keys/list.

Example using cURL:

curl -X POST https://target-litellm-instance/user/update \
  -H "Authorization: Bearer <your_token>" \
  -H "Content-Type: application/json" \
  -d '{"user_id": "user_abc123", "user_role": "proxy_admin"}'

Post-Exploitation:

• Extract all API keys and model configurations.
• View prompt history to gather sensitive data.
• Create or delete users and teams.

Blue Team

Detection:

• Monitor logs for unusual changes to the user_role field, especially from non-admin users.
• Alert on requests to /user/update that include the user_role parameter.

Hunting:

• Search for users with proxy_admin role who were not originally assigned that role.
• Review audit logs for role changes.

Prevention:

• Apply the patch immediately (upgrade to 1.83.10+).
• If patching is delayed, implement a Web Application Firewall (WAF) rule to block requests to /user/update containing the user_role field.
• Restrict network access to the /user/update endpoint to trusted IPs only.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /user/update with a JSON body containing "user_role": "proxy_admin".
• Logs: Audit log entries showing a user's role changing from a lower privilege (e.g., app_user) to proxy_admin.
• System: Unexpected creation of new API keys or deletion of users by a user who was previously non-admin.
• File: No specific file-based IOCs; this is a logic flaw in the application.

Detection Engineering

YARA Rule

rule CVE_2026_47102_LiteLLM_PrivEsc {
    meta:
        description = "Detects exploitation attempts of CVE-2026-47102 in LiteLLM logs"
        author = "Valters IT"
        date = "2026-01-01"
        severity = "high"
    strings:
        $s1 = "/user/update" ascii wide nocase
        $s2 = "user_role" ascii wide nocase
        $s3 = "proxy_admin" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2026-47102 - LiteLLM Privilege Escalation via /user/update
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests to /user/update with user_role set to proxy_admin
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/user/update'
        cs-uri-query|contains: 'user_role'
        cs-uri-query|contains: 'proxy_admin'
    condition: selection
falsepositives:
    - Legitimate admin actions (should be rare)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2026-47102 - LiteLLM Privilege Escalation Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/user/update"; http_uri;
    content:"user_role"; http_client_body;
    content:"proxy_admin"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade LiteLLM to version 1.83.10 or later. This is the only complete fix.
2. If immediate upgrade is not possible, implement a WAF rule to block requests to /user/update that contain the user_role field.
3. Review all user accounts for unauthorized role changes. Revoke any proxy_admin roles that were not explicitly assigned.

Long-Term Measures:

• Implement strict input validation on all API endpoints.
• Use role-based access control (RBAC) with field-level permissions.
• Enable comprehensive audit logging for all user management actions.
• Regularly review and rotate API keys.

Workaround:

• Disable the /user/update endpoint entirely if self-service user updates are not required. This can be done by removing the route in the application configuration or using a reverse proxy to block it.

Valters IT
Securing Digital Frontiers