CVE-2025-0330: berriai berriai/litellm

Vulnerability summary

CVE-2025-0330 is a high (CVSS 7.5) vulnerability in berriai berriai/litellm. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 45.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 20-03-2025
   PublishedVulnerability first disclosed.
2. 20-03-2025
   Last modifiedVulnerability information updated.

Description

In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error occurs while parsing team settings. This vulnerability exposes sensitive information, including langfuse_secret and langfuse_public_key, which can provide full access to the Langfuse project storing all requests.

• CWE-1230Exposure of Sensitive Information Through MetadataThe product prevents direct access to a resource containing sensitive information, but it does not sufficiently limit access to metadata that is derived from the original, sensitive information.