CVE-2026-47101
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
A vulnerability in LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes not permitted by their role. The allowed_routes field is stored without verifying that the specified routes fall within the user's own permissions, enabling privilege escalation to proxy_admin.
Risk Assessment
The organization is at risk of unauthorized access to administrative functions, potentially leading to full compromise of the proxy server and possible data leakage or service disruption.
Recommendation
Immediately upgrade LiteLLM to version 1.83.14 or later, which includes a fix preventing the creation of API keys with routes beyond the user's permissions.
Original NVD description (English source)
LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit. When generating a key, the allowed_routes field is stored without verifying that the specified routes fall within the user's own permissions. A key created with access to admin-only routes can then be used to reach those routes successfully, bypassing the role-based access controls that would otherwise block the request, enabling full privilege escalation from internal_user to proxy_admin.