LiteLLM CVE-2026-42271 is now in CISA’s Known Exploited Vulnerabilities catalog. CISA added the issue on June 8, 2026, with a due date of June 22, 2026 for covered federal systems. The GitHub advisory for BerriAI LiteLLM lists affected pip package versions from 1.74.2 through versions before 1.83.7, with patched versions at 1.83.7 or newer.
This matters anywhere LiteLLM is used as an AI gateway, OpenAI-compatible proxy, model routing layer, internal developer service, agency automation backend, or SaaS support tool. A low-privilege authenticated key may be enough to reach the vulnerable behavior, so this should be handled as more than a normal library update.
This is a protect-only guide. It explains the safe update, key review, access-control, and verification path without publishing route names, proof steps, or abuse details.
What is affected
- BerriAI LiteLLM package versions 1.74.2 through versions before 1.83.7.
- LiteLLM proxy or AI gateway deployments where authenticated users or service keys can reach management or MCP preview behavior.
- Docker, Kubernetes, VM, and bare-metal installs that have not moved to the fixed release line.
- Internal automations that treat LiteLLM keys as low risk because they are not full administrator accounts.
NVD rates the vulnerability as High, and the official CVE record lists a CVSS 4.0 base score of 8.7. The important operational point is simple: find every LiteLLM proxy, update it, and then review the trust level of every key that could reach the proxy.
What to do now
- Inventory LiteLLM gateways. Check cloud VMs, Docker hosts, Kubernetes namespaces, internal tools, agency automation stacks, customer support systems, and SaaS backend services.
- Confirm the running version. Treat any LiteLLM deployment from 1.74.2 up to, but not including, 1.83.7 as affected until you verify a fixed build.
- Back up before the change. Save configuration, provider routing, budgets, team and organization settings, database backups, secret-manager references, and deployment manifests.
- Update to 1.83.7 or newer. Use the official release and advisory as your source of truth. For containers, pin the intended tag or digest and follow LiteLLM’s release notes for image-signature verification.
- Roll production carefully. In Kubernetes or clustered setups, roll one replica or node group at a time, watch readiness checks, and keep a rollback handle until model routes are verified.
- Review and rotate keys. Rotate master, admin, service, internal-user, team, and provider API keys when exposure is plausible. Remove unused keys and narrow roles for users that only need model access.
- Restrict proxy reachability. Keep management and administrative paths off the open internet, require strong authentication, limit trusted networks, and put rate and anomaly monitoring around exposed API traffic.
- Review logs after patching. Look for unusual key use, unexpected configuration changes, abnormal outbound activity, provider-account usage spikes, and strange process or service behavior on the proxy host.
Hosting and SaaS notes
If LiteLLM sits between your app and paid model providers, the security review should include both the gateway and the accounts behind it. Rotate provider credentials if you see suspicious use, unexpected spend, odd model calls, or signs that a service key was wider than intended.
For hosted customer environments, document the maintenance window, expected API behavior, rollback plan, and post-update checks. Model routing, streaming responses, budgets, rate limits, customer isolation, and provider failover should all be verified after the update.
Post-update verification checklist
- LiteLLM reports version 1.83.7 or newer across every production instance.
- Container tags or package locks match the intended fixed build.
- Health checks, readiness probes, and monitoring dashboards are normal.
- Known-good model routes still work for OpenAI-compatible clients and internal tools.
- Budgets, teams, organizations, rate limits, and provider keys still behave as expected.
- Old internal-user, service, and administrator keys have been reviewed or rotated.
- Logs show no suspicious key use, configuration changes, provider spend spikes, or abnormal host behavior.
Related Fix I.T. Phill reading
- Check Point CVE-2026-50751 VPN patch guide
- SolarWinds Serv-U CVE-2026-28318 KEV patch guide
- CIFSwitch CVE-2026-46243 Linux kernel patch guide
- How to check backups and restore points
Sources
- CISA Known Exploited Vulnerabilities catalog
- GitHub advisory for LiteLLM CVE-2026-42271
- LiteLLM v1.83.7-stable release notes
- NVD entry for CVE-2026-42271
- Official CVE API record for CVE-2026-42271
Need help finding every AI gateway before a patch window? Fix I.T. Phill can help inventory the proxy, check the update path, protect keys, and verify model routes after the change.
