fix(deps): update dependency litellm to v1.94.0 [security] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
litellm	==1.93.0 → ==1.94.0

---

LiteLLM: Authentication Bypass via Host Header Injection

CVE-2026-49468 / GHSA-4xpc-pv4p-pm3w

More information

Details

Impact

A Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes.

The auth layer derived the effective route from request.url.path in litellm/proxy/auth/auth_utils.py::get_request_route(), which Starlette reconstructs from the Host header. A crafted Host could therefore make the auth gate evaluate a different route from the one FastAPI dispatched.

Most deployments are not affected. The bypass is blocked by any upstream layer that validates or normalizes Host, such as:

• a CDN or WAF, such as Cloudflare
• a reverse proxy with server_name allowlists
• a host-based load balancer

LiteLLM Cloud customers are not affected.

Patches

Fixed in 1.84.0. Upgrade to 1.84.0 or later. No configuration change is required.

Workarounds

If upgrading is not immediately possible, place the proxy behind an upstream component that validates or normalizes the Host header before forwarding (a CDN/WAF, a reverse proxy with explicit server_name allowlists, or a cloud load balancer with host-based routing rules), or otherwise restrict network access to the proxy listener.

References

• Patched release: v1.84.0

Discovery Credit: Le The Thang (KCSC) and Kim Ngoc Chung (One Mount Group)

Severity

• CVSS Score: 9.5 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

• https://github.com/BerriAI/litellm/security/advisories/GHSA-4xpc-pv4p-pm3w
• https://github.com/BerriAI/litellm/releases/tag/v1.84.0
• https://nvd.nist.gov/vuln/detail/CVE-2026-49468
• https://access.redhat.com/security/cve/CVE-2026-49468
• https://bugzilla.redhat.com/show_bug.cgi?id=2491520
• https://github.com/BerriAI/litellm
• https://github.com/advisories/GHSA-4xpc-pv4p-pm3w
• https://github.com/pypa/advisory-database/tree/main/vulns/litellm/PYSEC-2026-388.yaml
• https://pypi.org/project/litellm
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49468.json

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

CVE-2026-59822 / GHSA-7488-6r32-c95q

More information

Details

Impact

LiteLLM's MCP Streamable HTTP endpoint could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.

The MCP auth handler supported OAuth2 passthrough for upstream MCP servers, but the fallback path could replace failed LiteLLM key validation with an empty UserAPIKeyAuth() object. This allowed requests with a fabricated Authorization header to reach MCP tooling without a valid LiteLLM key.

An attacker could use this to list and call configured MCP tools and access connected services exposed through MCP.

Patches

The issue is fixed in 1.84.0.

We recommend upgrading to 1.84.0 or later.

Workarounds

If upgrading is not immediately possible, disable MCP routes or block access to /mcp/ and related MCP endpoints at your reverse proxy or API gateway.

References

• v1.84.0

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q
• https://nvd.nist.gov/vuln/detail/CVE-2026-59822
• https://github.com/BerriAI/litellm/pull/26463
• https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c
• https://github.com/BerriAI/litellm/releases/tag/v1.84.0
• https://github.com/advisories/GHSA-7488-6r32-c95q

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: services/aimer-web/uv.lock

Command failed: uv lock --upgrade-package litellm
Using CPython 3.13.14 interpreter at: /opt/containerbase/tools/python/3.13.14/bin/python3
  × No solution found when resolving dependencies:
  ╰─▶ Because openrag>=0.5.0,<=0.5.1 depends on litellm==1.83.14 and your
      project depends on litellm==1.94.0, we can conclude that your project
      and openrag>=0.5.0,<=0.5.1 are incompatible.
      And because your project depends on openrag>=0.5.0,<0.6.0, we can
      conclude that your project's requirements are unsatisfiable.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Coverage ∅ diff coverage · +0.00% coverage variation

Metric	Results
Coverage variation	✅ +0.00% coverage variation (-1.00%)
Diff coverage	✅ ∅ diff coverage

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (a0f34ed)	720	517	71.81%
Head commit (5b646e2)	720 (+0)	517 (+0)	71.81% (+0.00%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#1038)	0	0	∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}