LiteLLMGHSA-g5pg-73fc-hjwq
LiteLLM Reveals Portion of API Key via a Logging File
High7.5CVE-2024-9606 · Published Mar 20, 2025 · updated Sep 10, 2026
In berriai/litellm before version 1.44.12, the `litellm/litellm_core_utils/litellm_logging.py` file contains a vulnerability where the API key masking code only masks the first 5 characters of the key. This results in the leakage of almost the entire API key in the logs, exposing a significant amount of the secret key. The issue affects version v1.44.9.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| litellm PyPI | < 1.44.12 | 1.44.12 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-117
- Also known as
- CVE-2024-9606, PYSEC-2026-1548
More LiteLLM advisories
All LiteLLM| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 202025 | LiteLLM Has a Leakage of Langfuse API Keys High7.5Mar 20, 2025 | High7.5 | No fix yet |
| Mar 202025 | LiteLLM Has an Improper Authorization VulnerabilityHigh8.1Mar 20, 2025 | High8.1 | 1.61.15 |
| Mar 202025 | LiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP RequestHigh7.5Mar 20, 2025 | High7.5 | 1.56.2 |
| Mar 202025 | LiteLLM Vulnerable to Remote Code Execution (RCE)High8.8Mar 20, 2025 | High8.8 | No fix yet |
| Mar 202025 | LiteLLM Vulnerable to Denial of Service (DoS)High7.5Mar 20, 2025 | High7.5 | 1.53.1.dev1 |
| Sep 132024 | LiteLLM Server-Side Request Forgery (SSRF) vulnerabilityHigh7.5Sep 13, 2024 | High7.5 | 1.44.8 |