CVE-2026-47102Disclosure(litellm / litellm)

Attackers rarely need one devastating flaw. They need a sequence of small ones, each unlocking the next. CVE-2026-47101, CVE-2026-47102, CVE-2026-40217: a low-privilege token widened, access escalated to admin, code execution reaching the host. Two layers stopped it: ▪️WAF Copilot blocked the privilege escalation at the edge. ▪️The runtime sensor identified and blocked the code execution inside the app, before a CVE existed for it. Miggo Head of Architecture, Ben Stav, walks through the full chain, with equal parts technical rigor and few quirky memes. https://www.miggo.io/post/defense-in-depth-in-action-how-to-stop-the-litellm-chain-cve-2026-47101-cve-2026-47102-cve-2026-40217-with-panache

Defense-in-Depth in Action: How to Stop the LiteLLM Chain (CVE-2026-47101, CVE-2026-47102, CVE-2026-40217) with Panache https://api.cyfluencer.com/s/defense-in-depth-in-action-how-to-stop-the-litellm-chain-cve-2026-47101-cve-2026-47102-cve-2026-40217-with-panache-28947/1

🔴 Four AI tools broke same way in two weeks: prompt injection, privilege escalation, path traversal Varonis disclosed SearchLeak (CVE-2026-42824) on June 15—a silent exfiltration chain in Microsoft 365 Copilot Enterprise Search. A crafted URL triggers Copilot to search a victim's mailbox and leak data through a Bing SSRF with no user interaction or warning. Four days earlier, Obsidian Security published three chained CVEs against LiteLLM: CVE-2026-47101 (authorization bypass), CVE-2026-47102 (privilege escalation to proxy admin), and CVE-2026-40217 (sandbox escape via exec()). Combined CVSS 9.9.

LiteLLM's virtual-key endpoint accepts an allowed_routes array from any internal_user. CVE-2026-47101 stores ["/*"] without role validation, granting the key access to every path. CVE-2026-47102 uses the key to call /user/update and set user_role to "proxy_admin" on the same record. CVE-2026-40217 then runs arbitrary Python through the Custom Code Guardrail test page. The exec() environment restores __builtins__ despite the explicit omission, exposing open and os.system. The full chain reaches the master key, provider credentials, and all traffic. Fixed in v1.83.14-stable. A privilege boundary enforced only by the value of one field is not a boundary.

#1 BREAKING: Two critical bugs CVE-2026-47101 and CVE-2026-47102 in LiteLLM before 1.83.14 let internal users escalate to proxy_admin and gain full administrative access. https://threatcluster.io/cluster/critical-privilege-escalation-vulnerabilities-in-litellm-dis-81c99f5f