CVE-2026-47101: berriai litellm Incorrect Authorization

Vulnerability summary

CVE-2026-47101 is a high (CVSS 8.8) Incorrect Authorization vulnerability in berriai litellm. EPSS estimates a 1.33% chance of exploitation in the next 30 days, higher than 70.6% of scored vulnerabilities. 3 public exploits are recorded.

Timeline

1. 21-05-2026
   PublishedVulnerability first disclosed.
2. 08-10-2026
   Last modifiedVulnerability information updated.

Description

LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit. When generating a key, the allowed_routes field is stored without verifying that the specified routes fall within the user's own permissions. A key created with access to admin-only routes can then be used to reach those routes successfully, bypassing the role-based access controls that would otherwise block the request, enabling full privilege escalation from internal_user to proxy_admin.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.