Advisoriesby IbisLiteLLMGHSA-879v-fggm-vxw2
LiteLLM Has a Leakage of Langfuse API Keys
No fix yet
In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error occurs while parsing team settings. This vulnerability exposes sensitive information, including langfuse_secret and langfuse_public_key, which can provide full access to the Langfuse project storing all requests.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| litellm PyPI | <= 1.52.1 | No fix yet |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-1230
- Also known as
- CVE-2025-0330, PYSEC-2026-1543
More LiteLLM advisories
All LiteLLM
LiteLLM Has an Improper Authorization VulnerabilityCVE-2025-0628fixed in 1.61.15LiteLLM Reveals Portion of API Key via a Logging FileCVE-2024-9606fixed in 1.44.12LiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP RequestCVE-2024-8984fixed in 1.56.2LiteLLM Vulnerable to Remote Code Execution (RCE)CVE-2024-6825no fix yetLiteLLM Vulnerable to Denial of Service (DoS)CVE-2024-10188fixed in 1.53.1.dev1LiteLLM Server-Side Request Forgery (SSRF) vulnerabilityCVE-2024-6587fixed in 1.44.8