Executive Summary
Researchers at Obsidian Security have disclosed a critical vulnerability chain in LiteLLM, a popular open-source AI gateway used to manage multiple model providers. By chaining CVE-2026-47101, CVE-2026-47102, and CVE-2026-40217, an attacker with default internal user access can achieve full administrative control and remote code execution (RCE). The chain involves an authorization bypass in API key generation, a lack of field restriction in user updates, and a sandbox escape in the Custom Code Guardrail feature.
Technically, the attack begins with minting a virtual API key with wildcard route permissions, which grants access to the administrative /user/update endpoint. Attackers can then promote themselves to 'proxy_admin' and exploit the Python exec() function in guardrails to obtain a reverse shell. This compromise is particularly severe as LiteLLM sits at a central chokepoint, exposing plaintext API keys for providers like OpenAI and Anthropic, and allowing attackers to forge model responses to manipulate downstream AI agents.
The business impact is high, as a compromised gateway allows for the interception of sensitive PII, source code, and internal credentials. Furthermore, LiteLLM has been a recent target of supply-chain backdoors by TeamPCP and active exploitation of other flaws (CVE-2026-42271 and CVE-2026-42208). Organizations using LiteLLM must upgrade to version v1.83.14-stable or later immediately and audit their configurations for unauthorized callbacks or administrative accounts.