Critical LiteLLM Flaw CVE-2024-4236 Lets Attackers Bypass Authentication

Key Takeaways

• A critical authentication bypass vulnerability, CVE-2026-49468, has been discovered in LiteLLM, a popular proxy for managing large language model APIs.
• The flaw allows unauthorized access by manipulating the Host header, causing a discrepancy between authentication and routing logic.
• LiteLLM versions prior to 1.84.0 are affected, carrying a critical CVSS v4 score due to its network-based, low-complexity attack vector that requires no authentication or user interaction.
• Most deployments behind robust upstream infrastructure (CDNs, WAFs, specific reverse proxies, cloud load balancers) are naturally mitigated. LiteLLM Cloud customers are also protected.
• Users should upgrade to LiteLLM version 1.84.0 immediately; temporary mitigations include strict Host header validation via upstream components or restricting network access.

Critical LiteLLM Flaw Exposes LLM API Proxies to Authentication Bypass

A significant security vulnerability has been identified in LiteLLM, a widely adopted proxy solution designed for orchestrating large language model (LLM) APIs. The flaw, designated as CVE-2026-49468, enables attackers to circumvent authentication protocols under specific circumstances by exploiting how the system processes the Host header.

This critical issue impacts LiteLLM installations running versions earlier than 1.84.0. The core of the vulnerability lies in a discrepancy in how the LiteLLM proxy determines request paths during its authentication routines.

The authentication process within LiteLLM relies on the request.url.path value, which is generated by the Starlette framework. This framework reconstructs the request path using the Host header provided in incoming HTTP requests. Attackers can exploit this by crafting a malicious Host header, effectively tricking the authentication layer into evaluating a different route than the one FastAPI ultimately processes. This divergence creates a critical window for attackers to bypass access controls and gain unauthorized entry to sensitive management interfaces.

Understanding the LiteLLM Vulnerability

The vulnerability is categorized as CWE-290 (Authentication Bypass by Spoofing) and has been assigned a high CVSS v4 score, indicating a severe potential impact on confidentiality, integrity, and availability. Its danger is amplified by the fact that it requires neither prior authentication nor any user interaction, making it particularly perilous in environments accessible from the internet. The attack vector is network-based and of low complexity, further elevating its risk profile.

However, a GitHub advisory (GHSA-4xpc-pv4p-pm3w) notes that many deployments are not susceptible to this specific attack. This is because the vulnerability is effectively mitigated when upstream infrastructure components, such as content delivery networks (CDNs), web application firewalls (WAFs), reverse proxies with stringent server_name validation, or cloud load balancers configured for host-based routing, validate or normalize the Host header before it reaches LiteLLM. Additionally, customers utilizing LiteLLM Cloud are not affected, as the hosted service incorporates protective measures against Host header manipulation.

The vulnerability has been addressed in LiteLLM version 1.84.0. Users are strongly urged to upgrade their installations without delay. The patch is designed for straightforward implementation, requiring no additional configuration changes.

Security researchers Le The Thang from KCSC and Kim Ngoc Chung from One Mount Group are credited with discovering this vulnerability. Their findings underscore the inherent risks associated with improper request parsing in contemporary API frameworks, particularly when relying on client-controlled headers. This incident serves as a crucial reminder for developers to prioritize robust input header validation and ensure consistent logic between routing and authentication layers in web applications, especially those managing sensitive AI workloads.

What You Should Do

• Upgrade Immediately: Update all LiteLLM instances to version 1.84.0 or newer to apply the official patch.
• Implement Upstream Validation: If immediate upgrade is not feasible, ensure your LiteLLM proxy is deployed behind a trusted upstream component (e.g., CDN, WAF, reverse proxy, load balancer) that performs strict validation and normalization of the Host header.
• Restrict Network Access: Limit network exposure to the LiteLLM proxy service by restricting access to only trusted IP addresses or internal networks.
• Review Configuration: Verify that any reverse proxies or load balancers in front of LiteLLM are configured with robust server_name validation rules.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.