{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T16:42:00.965Z",
  "tag": {
    "id": "litellm",
    "label": "LiteLLM",
    "isStack": false,
    "url": "https://pwn.watch/t/litellm",
    "feed": "https://pwn.watch/t/litellm/feed.xml"
  },
  "counts": {
    "incidents": 4,
    "live": 1,
    "notFullyPatched": 0,
    "patched": 4
  },
  "incidents": [
    {
      "slug": "litellm-1-107-0-pypi-compromise",
      "title": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise",
      "json": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "LiteLLM (PyPI + official Docker/GHCR images)",
      "tags": [
        "python",
        "pypi",
        "docker",
        "ai",
        "litellm",
        "supply-chain"
      ],
      "cveIds": [
        "MAL-2026-2144"
      ],
      "affectedVersions": [
        "litellm==1.107.0; Docker/GHCR tags v1.107.0, latest, main-latest, main-stable during the Oct 21 window"
      ],
      "fixedVersions": [
        "1.106.2 (pin; last known safe). Malicious 1.107.0 removed from PyPI, Docker Hub and GHCR"
      ],
      "startedAt": "2026-10-21",
      "closedAt": null,
      "updatedAt": "2026-10-22T16:00:44+02:00",
      "summary": "On Oct 21 2026 attackers compromised LiteLLM’s release pipeline and published malicious litellm==1.107.0 to PyPI (live ~2 hours) plus compromised Docker Hub/GHCR tags (v1.107.0, latest, main-latest, main-stable). The wheels install cook.pth / cook.py / sitecustomize.py that steal cloud, developer and AI-tool credentials at every Python startup and open a remote-code loader. Second LiteLLM compromise of 2026.",
      "xPost": null
    },
    {
      "slug": "berriai-litellm-cve-2026-59822",
      "title": "BerriAI LiteLLM: BerriAI LiteLLM Improper Authentication Vulnerability",
      "url": "https://pwn.watch/i/berriai-litellm-cve-2026-59822",
      "json": "https://pwn.watch/i/berriai-litellm-cve-2026-59822.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "BerriAI LiteLLM",
      "tags": [
        "python",
        "ai",
        "litellm",
        "mcp",
        "cisa-kev",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2026-59822"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-02",
      "closedAt": "2026-09-02",
      "updatedAt": "2026-09-02",
      "summary": "BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. Added to CISA KEV on 2026-09-02.",
      "xPost": null
    },
    {
      "slug": "berriai-litellm-cve-2026-42271",
      "title": "BerriAI LiteLLM: BerriAI LiteLLM Command Injection Vulnerability",
      "url": "https://pwn.watch/i/berriai-litellm-cve-2026-42271",
      "json": "https://pwn.watch/i/berriai-litellm-cve-2026-42271.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "BerriAI LiteLLM",
      "tags": [
        "python",
        "ai",
        "litellm",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2026-42271",
        "CVE-2026-48710"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-06-08",
      "closedAt": "2026-06-08",
      "updatedAt": "2026-09-02",
      "summary": "BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host. CISA added CVE-2026-42271, CVE-2026-48710 to the Known Exploited Vulnerabilities catalog on 2026-06-08 based on evidence of active exploitation.",
      "xPost": null
    },
    {
      "slug": "berriai-litellm-cve-2026-42208",
      "title": "BerriAI LiteLLM: BerriAI LiteLLM SQL Injection Vulnerability",
      "url": "https://pwn.watch/i/berriai-litellm-cve-2026-42208",
      "json": "https://pwn.watch/i/berriai-litellm-cve-2026-42208.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "BerriAI LiteLLM",
      "tags": [
        "python",
        "ai",
        "litellm",
        "cisa-kev",
        "sql-injection"
      ],
      "cveIds": [
        "CVE-2026-42208"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-05-08",
      "closedAt": "2026-05-08",
      "updatedAt": "2026-05-08",
      "summary": "BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages. Added to CISA KEV on 2026-05-08.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "Help Net Security",
      "handle": "helpnetsecurity",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1602979161932455937/3RwfWo0d_bigger.jpg",
      "text": "LiteLLM hit by second supply chain attack this year, users urged to rotate credentials - https://t.co/7iolIMAKe8 - @GossiTheDog @RockHudsonRock @cloudsek @wiz_io @AikidoSecurity @SocketSecurity - #LiteLLM #SupplyChainAttack #OpenSource #malware #Cybersecurity #CyberSecurityNews https://t.co/ZLPywonXYC",
      "date": "2026-10-22T13:26:50.000Z",
      "url": "https://x.com/helpnetsecurity/status/2113260794544796098",
      "media": [],
      "incident": "litellm-1-107-0-pypi-compromise"
    },
    {
      "authorName": "The Hacker News",
      "handle": "TheHackersNews",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1597647879811657728/FLgHrLHy_bigger.jpg",
      "text": "🚨 LiteLLM 1.107.0 compromised in a supply chain attack.\n\nMalicious PyPI packages and Docker images delivered a credential stealer and backdoor.\n\n⚠️ The malware runs at Python startup, targeting cloud credentials, private keys, and AI tool credentials.\n\n🔗 Full story: https://t.co/ANqBuYaGx5",
      "date": "2026-10-21T18:02:10.000Z",
      "url": "https://x.com/TheHackersNews/status/2112967698103894257",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVLE6tcakAATDtC.jpg"
        }
      ],
      "incident": "litellm-1-107-0-pypi-compromise"
    },
    {
      "authorName": "Moshe Siman Tov Bustan",
      "handle": "MosheTov",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1998067906706345984/SwYIhsPZ_bigger.jpg",
      "text": "❗ If 2 PHP vulns weren't enough for one day (or, 0-day?) - LiteLLM were compromised today by a combined RAT Infostealer malware!\n\nTLDR - LiteLLM PyPI ver 1.107.0 is compromised, if you installed it - revoke keys and change passwords ASAP.\n\nThe malware combines two threats in one https://t.co/WjpMeKcVgg",
      "date": "2026-10-21T15:46:21.000Z",
      "url": "https://x.com/MosheTov/status/2112933514962247891",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVKl1H6XQAAPSJw.jpg"
        }
      ],
      "incident": "litellm-1-107-0-pypi-compromise"
    },
    {
      "authorName": "Cyber Security News",
      "handle": "The_Cyber_News",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1174924326807592960/aJMuU6Ms_bigger.jpg",
      "text": "‼️ Breaking: LiteLLM Compromised – Infostealer and RAT Injected in 1.107.0 PyPI Release\n\nDetails: https://t.co/8rlH8xijjj\n\nLiteLLM version 1.107.0 was compromised on PyPI on October 21, 2026, spreading a credential stealer and a remote access trojan through all seven distributed https://t.co/caDoffOmFx",
      "date": "2026-10-21T15:21:29.000Z",
      "url": "https://x.com/The_Cyber_News/status/2112927256956088756",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVKf10bawAAfyb6.jpg"
        }
      ],
      "incident": "litellm-1-107-0-pypi-compromise"
    },
    {
      "authorName": "Socket",
      "handle": "SocketSecurity",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2057141188591824896/aKdKFNEE_bigger.jpg",
      "text": "🚨 LiteLLM, a Python package for connecting to AI model providers with 92M+ monthly downloads, has been compromised.\n\nVersion 1.107.0 ships credential-stealing malware through PyPI wheels and Docker images, targeting cloud credentials, developer secrets, and AI tools. https://t.co/4Mbt1LbhLu",
      "date": "2026-10-21T14:03:54.000Z",
      "url": "https://x.com/SocketSecurity/status/2112907732877775016",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVKNz_RWYAAoI1O.jpg"
        }
      ],
      "incident": "litellm-1-107-0-pypi-compromise"
    }
  ],
  "changes": [
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "LiteLLM root cause: attacker held three developer GitHub CLI tokens, likely scraped from logs of an internet-exposed internal LiteLLM deployment (Claude Code can echo a gh OAuth token into logged response bodies), disabled branch protection and ran the release workflow against lookalike repo Berri-AI/litellm.",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html",
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "StepSecurity full teardown: payload exfiltrates to lookalike www.litellm.dev (registered Oct 13) and an hourly loader polls a GitHub dead drop (letters9813/pythonclient-test, now deleted). Infected hosts keep polling, so anyone re-registering that username could run code on them: kill the process holding /tmp/remote_code_loader.lock, delete cook.pth/cook.py/sitecustomize.py, pin 1.106.2 and rotate everything.",
      "body": null,
      "sourceUrl": "https://www.stepsecurity.io/blog/litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer",
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21T11:39Z",
      "title": "Malicious 1.107.0 wheels appear on PyPI.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21T11:39Z",
      "title": "Malicious litellm==1.107.0 (all seven wheels) live on PyPI 11:39-13:23 UTC; Docker tags v1.107.0/latest/main-latest/main-stable compromised 11:46-14:20 UTC.",
      "body": null,
      "sourceUrl": "https://docs.litellm.ai/blog/security-incident-oct-21-2026",
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21T13:23Z",
      "title": "PyPI quarantines/pulls the package (~2h window).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21T14:20Z",
      "title": "Docker Hub tags cleaned / retargeted; GHCR images made unavailable earlier.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21T16:20Z",
      "title": "Wiz sees stolen AWS instance-role credentials validated from 168.100.8.57 and 165.227.201.8 (sts:GetCallerIdentity, then Bedrock model listing), consistent with LLMjacking.",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html",
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21T20:30Z",
      "title": "LiteLLM posts containment update; investigation ongoing.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-19",
      "title": "LiteLLM temporarily expands release permissions for two internal engineers (daily bugfix backports).",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html",
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "berriai-litellm-cve-2026-59822",
      "incidentTitle": "BerriAI LiteLLM: BerriAI LiteLLM Improper Authentication Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-02",
      "title": "CISA added CVE-2026-59822 to the KEV catalog (due 2026-09-16).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/berriai-litellm-cve-2026-59822"
    },
    {
      "incident": "berriai-litellm-cve-2026-42271",
      "incidentTitle": "BerriAI LiteLLM: BerriAI LiteLLM Command Injection Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-06-08",
      "title": "CISA added CVE-2026-42271, CVE-2026-48710 to the KEV catalog (due 2026-06-22).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/berriai-litellm-cve-2026-42271"
    },
    {
      "incident": "berriai-litellm-cve-2026-42208",
      "incidentTitle": "BerriAI LiteLLM: BerriAI LiteLLM SQL Injection Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-05-08",
      "title": "CISA added CVE-2026-42208 to the KEV catalog (due 2026-05-11).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/berriai-litellm-cve-2026-42208"
    }
  ]
}