rpm package
opensuse/python-litellm&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/python-litellm&distro=openSUSE%20Tumbleweed
Vulnerabilities (3)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-93355 | Hig | 8.1 | < 1.103.0-1.1 | 1.103.0-1.1 | Sep 28, 2026 | LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without verifying the email_veri | |
| CVE-2026-89032 | Hig | 7.7 | < 1.103.0-1.1 | 1.103.0-1.1 | Sep 25, 2026 | BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other tenants' cached responses by exploiting a metadata key mismatch between _get_semantic_cache_tenant_scope() and _get_metad | |
| CVE-2026-84377 | Med | 6.5 | < 1.101.0-1.1 | 1.101.0-1.1 | Sep 2, 2026 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured p |
- affected < 1.103.0-1.1fixed 1.103.0-1.1
LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without verifying the email_veri
- affected < 1.103.0-1.1fixed 1.103.0-1.1
BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other tenants' cached responses by exploiting a metadata key mismatch between _get_semantic_cache_tenant_scope() and _get_metad
- affected < 1.101.0-1.1fixed 1.101.0-1.1
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured p