PyPI/litellm CVE-2026-49468: unknown, EPSS 3.03%

LiteLLM: Authentication Bypass via Host Header Injection

Action: Upgrade litellm to 1.84.0 or later.

pip install litellm==1.84.0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-388
• https://github.com/BerriAI/litellm/security/advisories/GHSA-4xpc-pv4p-pm3w
• https://github.com/BerriAI/litellm
• https://github.com/BerriAI/litellm/releases/tag/v1.84.0
• https://pypi.org/project/litellm
• https://github.com/advisories/GHSA-4xpc-pv4p-pm3w
• https://nvd.nist.gov/vuln/detail/CVE-2026-49468

CVE-2026-49468 · published 2026-06-29T11:50:52.648950Z · modified 2026-07-01T20:22:56.295059Z · JSON