LiteLLM Security.
This section contains technical analysis, security research, and proof-of-concept demonstrations for multiple LiteLLM security findings identified during source code reviews and vulnerability assessments.
The documented vulnerabilities cover authentication logic flaws, server-side request forgery (SSRF) primitives, and sandbox validation escapes via Unicode homoglyphs.
Authentication Bypass via Pass-the-Hash
A logic flaw in LiteLLM's API key validation allows authentication using a leaked SHA-256 key hash instead of the original API key, effectively enabling a pass-the-hash attack to compromise the platform.
SSRF via Custom Guardrails
Custom guardrail HTTP primitives allow unrestricted outbound requests to arbitrary URLs, including internal private network resources, local interfaces, and cloud metadata services.
Sandbox Escape via Unicode Normalization Bypass
The custom code validator fails to normalize Unicode before validating patterns, allowing forbidden attributes like __globals__ to bypass regex blacklists and execute successfully.
Repository Structure
litellm-vulnerability-research/
│
├── README.md
│
├── auth-bypass-pass-the-hash/
│ ├── README.md
│ └── poc.py
│
├── ssrf-custom-guardrails/
│ ├── README.md
│ └── poc.py
│
└── unicode-sandbox-escape/
├── README.md
└── poc.pyCoordinated Disclosure
The findings contained in this repository were originally reported through coordinated disclosure channels. The repository serves as a technical reference for researchers, defenders, and developers interested in understanding the root causes, impact, and exploitation paths of these vulnerabilities.
Disclaimer
This repository is intended for educational, defensive, and research purposes only. Do not test against systems you do not own or have explicit authorization to assess.