CVE-2026-12770: BerriAI LiteLLM improper authorization in key management endpoints

CVE-2026-12770 · Severity: medium · CVSS 5.4 · Published 2026-06-21

LiteLLM is a popular proxy server for managing API keys and LLM access control. A flaw in the key management system allows any internal user (a lower privilege level) to block or unblock any API key in the system, including those belonging to administrators. An attacker with basic internal access could disable critical production keys, causing service outages, or re-enable malicious keys without detection or audit trail.

Technologies: Berriai LiteLLM, litellm (PyPI). Vendors: Berriai, PyPI.

Quick answers

Is CVE-2026-12770 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-12770 being exploited in the wild.
How severe is CVE-2026-12770?
Medium severity, with a CVSS score of 5.4, published 21 June 2026.
Which products and versions are affected?
Berriai LiteLLM <= 1.63.1; litellm (PyPI) ECOSYSTEM:introduced=0,last_affected=1.63.1.
Is there a fix for CVE-2026-12770?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12770 attacked?
It is attacked over the network.
Am I affected by CVE-2026-12770?
Check whether you run Berriai LiteLLM or litellm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass (CWE-266, CWE-285) in the key_management_endpoints.py file within the /key/block and /key/unblock endpoints. These endpoints are included in internal_user_routes, meaning they pass initial middleware authentication checks for any internal_user token holder. However, the endpoint implementations (block_key and unblock_key functions) lack secondary authorization checks to verify that the requestor owns the target key or holds proxy_admin privileges. As a result, the application only validates the caller has internal_user role via middleware and then freely modifies the database status of any provided key string. The attack requires network access to the LiteLLM proxy and a valid internal_user API token, but no additional privileges or user interaction. An attacker can perform both denial-of-service (blocking keys) and potential privilege abuse (unblocking malicious keys). The vulnerability is exploitable and publicly disclosed; no patched version is currently available in the advisory.

Affected products

  • BerriAI litellm <= 1.63.1

Identifiers

  • CVE-2026-12770
  • GHSA-6qr3-3g89-m4jj
  • PYSEC-2026-4068

Timeline

  • 2026-03-21: disclosed: Vulnerability reported/disclosed
  • 2026-06-21: advisory: Published to GitHub Advisory Database and NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.