Skip to content
Advisories.
LiteLLMGHSA-qqcv-vg9f-5rr3

litellm vulnerable to improper access control in team management

Medium5.3CVE-2024-5710 · Published Jun 27, 2024 · updated Sep 10, 2026

berriai/litellm version 1.34.34 is vulnerable to improper access control in its team management functionality. This vulnerability allows attackers to perform unauthorized actions such as creating, updating, viewing, deleting, blocking, and unblocking any teams, as well as adding or deleting any member to or from any teams. The vulnerability stems from insufficient access control checks in various team management endpoints, enabling attackers to exploit these functionalities without proper authorization.

GitHub advisory

Affected versions

PackageAffectedFixed in
litellm
PyPI
< 1.40.151.40.15
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-284, CWE-862
Also known as
CVE-2024-5710, PYSEC-2026-1551

More LiteLLM advisories

All LiteLLM
Advisory
litellm vulnerable to remote code execution based on using eval unsafely
Critical9.8Jun 27, 2024
Arbitrary file deletion in litellm
High6.5Jun 6, 2024
SQL injection in litellm
Medium4.9Jun 6, 2024
SQL injection in litellm
Medium6.4Jun 6, 2024
litellm passes untrusted data to `eval` function without sanitization
High7.2May 18, 2024
LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint
Critical9.8Apr 10, 2024

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.