Security flaws found in top open source AI gateway — LiteLLM vulnerabilties could affect millions of users
- Two LiteLLM flaws let low-privileged users gain administrative control and execute malicious code
- Attackers could also steal AI provider API keys through a server-side request forgery bug
- Organizations should upgrade to LiteLLM 1.83.9+ and rotate potentially exposed credentials
Security researchers recently discovered two vulnerabilities in a popular AI gateway that allowed threat actors to take complete control of the system, steal sensitive files and AI provider API keys, and execute malicious code remotely.
The AI gateway in question is called LiteLLM. It is an open source solution allowing users to connect their applications to large language models (LLM) from different providers, including the likes of OpenAI and Anthropic.
The connection goes through a single interface, where users can route requests, manage API keys, control user access, and monitor things like usage and costs.
Right now, LiteLLM supports some 140 AI providers and has become quite popular - it has more...
Copyright of this story solely belongs to www.techradar.com. To see the full text click HERE
