Description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, a Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes. The auth layer derived the effective route from request.url.path in litellm/proxy/auth/auth_utils.py::get_request_route(), which Starlette reconstructs from the Host header. A crafted Host could therefore make the auth gate evaluate a different route from the one FastAPI dispatched. This vulnerability is fixed in 1.84.0.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
BerriAI litellm
< 1.84.0affected
References
- https://github.com/BerriAI/litellm/security/advisories/GHSA-4xpc-pv4p-pm3w ↗
- https://github.com/BerriAI/litellm/releases/tag/v1.84.0 ↗
- https://access.redhat.com/security/cve/CVE-2026-49468 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2491520 ↗
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49468.json ↗