PT-2025-40610 · Litellm · Litellm

Published 2025-10-03 · Updated 2025-10-29 · CVE-2025-11203

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions LiteLLM (affected versions not specified)

Description A flaw exists in LiteLLM that allows remote attackers to disclose sensitive information. Authentication is required for exploitation. The issue stems from the handling of the API KEY parameter within the health endpoint. This can lead to the disclosure of stored credentials and potential compromise.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-11203

ZDI-25-929

Affected Products

Litellm

References · 6

• https://zerodayinitiative.com/advisories/ZDI-25-929 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-11203 · Security Note
• https://docs.litellm.ai/release_notes/v1.63.14-stable · Vendor Advisory
• https://t.me/cveNotify/140895 · Telegram Post
• https://twitter.com/CVEnew/status/1983619147540910345 · Twitter Post
• https://t.me/CVEtracker/36111 · Telegram Post