CVE-2026-49468

BerriAI litellm is a “middleman” server that your app uses to talk to AI providers. This bug would let an attacker trick the server using a forged request address (the Host header), potentially getting past login checks. Think of it like showing a fake visitor badge by altering what entrance you claim you’re coming through—then receiving access you shouldn’t have.

This matters to you if you use or run BerriAI litellm versions prior to 1.84.0 as a public-facing service or accessible to the internet. If your litellm is not exposed to untrusted users, risk is lower, but it’s still a good idea to fix. The affected product is specifically BerriAI litellm.

Verdict: GREEN. There are no known public exploits, no evidence of exploitation in the wild reported by press, and it’s not listed as a known exploited vulnerability by CISA KEV. Even so, since it’s a real authentication bypass class issue and there’s a confirmed fix in 1.84.0, you should plan an update promptly rather than waiting months.

1. Inventory and confirm version:

• Identify the running BerriAI litellm version(s) (container image tag, package version, or deployment manifest).
• Confirm whether any instances are still running a version prior to 1.84.0.

2. Patch:

• Upgrade BerriAI litellm to 1.84.0 (or later if available in your release channel).
• Restart/redeploy the service after the upgrade so the running process uses the patched code.

3. Configuration and exposure checks:

• Ensure the litellm proxy is only reachable by intended clients (for example, from your app servers or approved IP ranges).
• If you use a reverse proxy (like Nginx/Traefik), review whether it forwards headers as-is in a way that could allow Host header manipulation. The key fix is the application update, but tightening exposure reduces the chance of abuse.

4. Monitor after the change:

• Watch logs for unusual authentication-related behavior (failed logins that suddenly succeed, unexpected requests with strange Host values, or spikes in request volume).
• Compare traffic patterns before/after the update to ensure normal clients still work.

5. Incident posture:

• If you cannot determine whether you were running a vulnerable version recently, treat the upgrade as urgent for hygiene and review logs for any suspicious requests around the timeframes you were online.

CVE-2026-49468 describes an authentication bypass in LiteLLM (BerriAI litellm) caused by Host header injection. The affected scope is prior to 1.84.0; the vulnerability is fixed in 1.84.0.

Given context from the prompt:

• Known exploited in the wild (CISA KEV): no
• Public exploit available: no
• Nuclei detection template exists: no
• Exploitation status (from press): none

Interpretation of risk for owners: because it’s an authentication bypass but not currently known to be actively exploited (per the provided facts), the recommended approach is patching to remove the possibility while it is still low-confidence for active abuse.

Exploitation status/monitoring notes:

• “CISA KEV” is a list of vulnerabilities that are known to be exploited in real attacks; this one is not on that list per your details.
• “EPSS/KEV” thresholds are not provided in the prompt, so no numeric likelihood scoring can be stated here.

Attack vector (high level): a client can craft requests that manipulate the Host header, and in vulnerable versions that can lead to bypassing authentication checks.