https://pwn.watch/t/litellm Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 22 Oct 2026 16:42:01 GMT https://pwn.watch/i/litellm-1-107-0-pypi-compromise litellm-1-107-0-pypi-compromise:2026-10-22:LiteLLM root cause: attacker held three developer GitHub CLI tokens, likely scraped from logs of an internet-exposed internal LiteLLM deployment (Claude Code can echo a gh OAuth token into logged response bodies), disabled branch protection and ran the release workflow against lookalike repo Berri-AI/litellm. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html Status: live, patched https://pwn.watch/i/litellm-1-107-0-pypi-compromise litellm-1-107-0-pypi-compromise:2026-10-22:StepSecurity full teardown: payload exfiltrates to lookalike www.litellm.dev (registered Oct 13) and an hourly loader polls a GitHub dead drop (letters9813/pythonclient-test, now deleted). Infected hosts keep polling, so anyone re-registering that username could run code on them: kill the process holding /tmp/remote_code_loader.lock, delete cook.pth/cook.py/sitecustomize.py, pin 1.106.2 and rotate everything. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.stepsecurity.io/blog/litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer Status: live, patched https://pwn.watch/i/litellm-1-107-0-pypi-compromise litellm-1-107-0-pypi-compromise:2026-10-21T11:39Z:Malicious 1.107.0 wheels appear on PyPI. Wed, 21 Oct 2026 00:00:00 GMT critical Status: live, patched https://pwn.watch/i/litellm-1-107-0-pypi-compromise litellm-1-107-0-pypi-compromise:2026-10-21T11:39Z:Malicious litellm==1.107.0 (all seven wheels) live on PyPI 11:39-13:23 UTC; Docker tags v1.107.0/latest/main-latest/main-stable compromised 11:46-14:20 UTC. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://docs.litellm.ai/blog/security-incident-oct-21-2026 Status: live, patched https://pwn.watch/i/litellm-1-107-0-pypi-compromise litellm-1-107-0-pypi-compromise:2026-10-21T13:23Z:PyPI quarantines/pulls the package (~2h window). Wed, 21 Oct 2026 00:00:00 GMT critical Status: live, patched https://pwn.watch/i/litellm-1-107-0-pypi-compromise litellm-1-107-0-pypi-compromise:2026-10-21T14:20Z:Docker Hub tags cleaned / retargeted; GHCR images made unavailable earlier. Wed, 21 Oct 2026 00:00:00 GMT critical Status: live, patched https://pwn.watch/i/litellm-1-107-0-pypi-compromise litellm-1-107-0-pypi-compromise:2026-10-21T16:20Z:Wiz sees stolen AWS instance-role credentials validated from 168.100.8.57 and 165.227.201.8 (sts:GetCallerIdentity, then Bedrock model listing), consistent with LLMjacking. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html Status: live, patched https://pwn.watch/i/litellm-1-107-0-pypi-compromise litellm-1-107-0-pypi-compromise:2026-10-21T20:30Z:LiteLLM posts containment update; investigation ongoing. Wed, 21 Oct 2026 00:00:00 GMT critical Status: live, patched https://pwn.watch/i/litellm-1-107-0-pypi-compromise litellm-1-107-0-pypi-compromise:2026-10-19:LiteLLM temporarily expands release permissions for two internal engineers (daily bugfix backports). Mon, 19 Oct 2026 00:00:00 GMT critical Source: https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html Status: live, patched https://pwn.watch/i/berriai-litellm-cve-2026-59822 berriai-litellm-cve-2026-59822:2026-09-02:CISA added CVE-2026-59822 to the KEV catalog (due 2026-09-16). Wed, 02 Sep 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/berriai-litellm-cve-2026-42271 berriai-litellm-cve-2026-42271:2026-06-08:CISA added CVE-2026-42271, CVE-2026-48710 to the KEV catalog (due 2026-06-22). Mon, 08 Jun 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/berriai-litellm-cve-2026-42208 berriai-litellm-cve-2026-42208:2026-05-08:CISA added CVE-2026-42208 to the KEV catalog (due 2026-05-11). Fri, 08 May 2026 00:00:00 GMT high Status: closed, patched