CVE-2026-12770BerriAI litellm Admin Key key_management_endpoints.py improper authorization

Descripción

A vulnerability was determined in BerriAI litellm up to 1.63.1. The impacted element is an unknown function of the file litellm/proxy/management_endpoints/key_management_endpoints.py of the component Admin Key Handler. This manipulation causes improper authorization. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 23781. It is recommended to apply a patch to fix this issue. The vendor was contacted early about this disclosure.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• VDB-372512 | BerriAI litellm Admin Key key_management_endpoints.py improper authorization vdb-entryThird Party AdvisoryVDB Entry
• VDB-372512 | CTI Indicators (IOB, IOC, TTP, IOA) signaturepermissions-requiredPermissions RequiredVDB Entry
• CVE-2026-12770 | CVE Analysis and Report third-party-advisoryThird Party AdvisoryVDB Entry
• Submit #811279 | litellm <= 1.63.1 Improper Authorization (CWE-285) third-party-advisoryThird Party AdvisoryVDB EntryExploit
• https://gist.github.com/YLChen-007/993c68152b2c770d53590f1684c755d4 exploitExploitThird Party Advisory
• https://github.com/BerriAI/litellm/pull/23781 issue-trackingpatchIssue TrackingPatch
• https://github.com/BerriAI/litellm/ productProduct