Executive brief
BerriAI litellm is a popular proxy and abstraction layer for large language models used by enterprises to manage API calls and enforce security policies. The product includes content filtering and safety guardrails (BannedKeywords and AzureContentSafety) intended to block harmful or policy-violating input before it reaches the underlying LLM. Due to a coding error where the security hooks check for the wrong routing type, these protections are completely disabled for all HTTP API requests, allowing attackers to bypass content filters silently. Organizations relying on these guardrails believe they have active protection when in fact no filtering occurs.
Technical details
The vulnerability is an improper authorization bypass (CWE-285) caused by an incorrect call_type comparison in two security hooks. When HTTP requests arrive at /v1/chat/completions, the proxy routes them asynchronously and sets call_type to "acompletion"; however, the BannedKeywords.async_pre_call_hook() and AzureContentSafety.async_pre_call_hook() functions only check for call_type == "completion", causing the condition to always evaluate false and the security check body to be skipped entirely. This allows requests containing banned keywords or unsafe content to bypass the guardrails. Other hooks in the codebase (presidio.py, guardrails_ai.py) were previously patched to check for both "completion" and "acompletion", indicating this was a known issue that was incompletely fixed. The vulnerability requires the attacker to have valid API credentials (low privilege) and can be exploited remotely over the network with no user interaction required. No patch has been released as of the advisory date.
Affected products
- BerriAI litellm <= 1.82.5
Timeline
- 2026-06-21: disclosed: Published to GitHub Advisory Database
- 2026-09-14: advisory: GitHub reviewed and confirmed