LiteLLM: vulnerability chain enables low-privilege account to seize AI proxy

Colleagues, please note: Obsidian Security disclosed a chain of vulnerabilities in LiteLLM. The combination of three bugs allows privilege escalation and RCE (CVE-2026-47101, CVE-2026-47102, CVE-2026-40217). Impact: full access to master keys, provider keys and database; ability to read and tamper with in-transit requests and execute covert RCE. Recommended actions: upgrade to LiteLLM v1.83.14-stable or later; review proxy_admin; verify Custom Code Guardrails and callbacks in config.yaml; rotate keys if compromise is suspected. Why it matters: a proxy vulnerability can not only exfiltrate data but also forge responses—critical for agents and integrations. Have you checked your LiteLLM deployments? #cybersecurity #AI #LiteLLM #infosec