Advisoriesby IbisLiteLLMGHSA-g5pg-73fc-hjwq
LiteLLM Reveals Portion of API Key via a Logging File
Fix: upgrade to 1.44.12 or later
In berriai/litellm before version 1.44.12, the litellm/litellm_core_utils/litellm_logging.py file contains a vulnerability where the API key masking code only masks the first 5 characters of the key. This results in the leakage of almost the entire API key in the logs, exposing a significant amount of the secret key. The issue affects version v1.44.9.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| litellm PyPI | < 1.44.12 | 1.44.12 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-117
- Also known as
- CVE-2024-9606, PYSEC-2026-1548
More LiteLLM advisories
All LiteLLM
LiteLLM Has a Leakage of Langfuse API KeysCVE-2025-0330no fix yetLiteLLM Has an Improper Authorization VulnerabilityCVE-2025-0628fixed in 1.61.15LiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP RequestCVE-2024-8984fixed in 1.56.2LiteLLM Vulnerable to Remote Code Execution (RCE)CVE-2024-6825no fix yetLiteLLM Vulnerable to Denial of Service (DoS)CVE-2024-10188fixed in 1.53.1.dev1LiteLLM Server-Side Request Forgery (SSRF) vulnerabilityCVE-2024-6587fixed in 1.44.8