CVE

CVE-2026-49468

9.5

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, a Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes. The auth layer derived the effective route from request.url.path in litellm/proxy/auth/auth_utils.py::get_request_route(), which Starlette reconstructs from the Host header. A crafted Host could therefore make the auth gate evaluate a different route from the one FastAPI dispatched. This vulnerability is fixed in 1.84.0.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

litellmexploit intelligencered hat ansible automation platform 2red hat openshift ai (rhoai)

Updated Nov 10, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~10 seconds

LiteLLM Proxy < 1.84.0 - Host Header Authentication Bypass

LiteLLM Proxy before 1.84.0 derives its public-route authorization check from a URL reconstructed with the unvalidated Host header. A Host value containing a fragment can make a protected request appear to target the public root route, bypassing the API-key check. Version 1.84.0 derives the route from the raw ASGI path instead. References: https://github.com/BerriAI/litellm/security/advisories/GHSA-4xpc-pv4p-pm3w https://github.com/BerriAI/litellm/releases/tag/v1.84.0 https://nvd.nist.gov/vuln/detail/CVE-2026-49468 Remediation: Upgrade LiteLLM Proxy to 1.84.0 or later.

Used 20 times · 10 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: litellm

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →