You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
A Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes.
The auth layer derived the effective route from request.url.path in litellm/proxy/auth/auth_utils.py::get_request_route(), which Starlette reconstructs from the Host header. A crafted Host could therefore make the auth gate evaluate a different route from the one FastAPI dispatched.
Most deployments are not affected. The bypass is blocked by any upstream layer that validates or normalizes Host, such as:
a CDN or WAF, such as Cloudflare
a reverse proxy with server_name allowlists
a host-based load balancer
LiteLLM Cloud customers are not affected.
Patches
Fixed in 1.84.0. Upgrade to 1.84.0 or later. No configuration change is required.
Workarounds
If upgrading is not immediately possible, place the proxy behind an upstream component that validates or normalizes the Host header before forwarding (a CDN/WAF, a reverse proxy with explicit server_name allowlists, or a cloud load balancer with host-based routing rules), or otherwise restrict network access to the proxy listener.
The following checks were performed on each of these signatures:
- The cosign claims were validated
- The signatures were verified against the specified public key
Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually
The artifact failure details are included below:
File name: services/aimer-web/uv.lock
Command failed: uv lock --upgrade-package litellm
Using CPython 3.13.14 interpreter at: /opt/containerbase/tools/python/3.13.14/bin/python3
× No solution found when resolving dependencies:
╰─▶ Because only openrag<=0.5.0 is available and openrag==0.5.0 depends
on litellm==1.83.14, we can conclude that openrag>=0.5.0 depends on
litellm==1.83.14.
And because your project depends on litellm==1.84.0 and openrag>=0.5.0,
we can conclude that your project's requirements are unsatisfiable.
Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>
Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer TIP This summary will be updated as you push new changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
renovate
Bot
added
dependencies
This PR contains the following updates:
==1.83.14→==1.84.0LiteLLM: Authentication Bypass via Host Header Injection
CVE-2026-49468 / GHSA-4xpc-pv4p-pm3w
More information
Details
Impact
A Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes.
The auth layer derived the effective route from
request.url.pathinlitellm/proxy/auth/auth_utils.py::get_request_route(), which Starlette reconstructs from theHostheader. A craftedHostcould therefore make the auth gate evaluate a different route from the one FastAPI dispatched.Most deployments are not affected. The bypass is blocked by any upstream layer that validates or normalizes
Host, such as:server_nameallowlistsLiteLLM Cloud customers are not affected.
Patches
Fixed in
1.84.0. Upgrade to1.84.0or later. No configuration change is required.Workarounds
If upgrading is not immediately possible, place the proxy behind an upstream component that validates or normalizes the
Hostheader before forwarding (a CDN/WAF, a reverse proxy with explicitserver_nameallowlists, or a cloud load balancer with host-based routing rules), or otherwise restrict network access to the proxy listener.References
v1.84.0Discovery Credit: Le The Thang (KCSC) and Kim Ngoc Chung (One Mount Group)
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
BerriAI/litellm (litellm)
v1.84.0Verify Docker Image Signature
All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit
0112e53.Verify using the pinned commit hash (recommended):
A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:
Verify using the release tag (convenience):
Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:
Expected output:
What's Changed
New Contributors
Full Changelog: BerriAI/litellm@v1.83.14-stable.patch.3...v1.84.0
Configuration
📅 Schedule: (in timezone Etc/UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.