CVE-2026-49468: LiteLLM: Authentication Bypass via Host Header Injection

Synopsis

An authentication bypass vulnerability exists in LiteLLM, an AI Gateway proxy server that routes requests to large language model APIs. An unauthenticated attacker can reach the service over the network and manipulate the HTTP Host header to bypass authentication controls, requiring no credentials and no victim interaction. Successful exploitation grants the attacker full read, write, and availability impact across both the vulnerable component and any systems it can reach. HarborGuard tracks the upstream advisory for patch availability, as no fix version has been published yet.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the LiteLLM service over the network; the CVSS vector specifies AV:N, meaning any internet- or intranet-exposed instance is in scope.

• AuthenticationNot required

  No credentials are needed; PR:N means the attacker exploits the Host header injection before any authentication check is applied.

• Victim interactionNot required

  The attack is fully server-side; UI:N means no user needs to click a link or take any action for exploitation to succeed.

• Attack complexityDetail

  The base exploit is condition-free (AC:L), though AT:P indicates a specific deployment configuration or timing condition must be present, making opportunistic mass exploitation somewhat less reliable.

Blast Radius

• The attacker bypasses authentication and reads all data handled by the LiteLLM proxy, including API keys, model routing configuration, and any request or response payloads in transit.
• The attacker can write to the proxy, enabling injection of arbitrary LLM requests, modification of routing rules, or manipulation of downstream API calls sent to connected LLM providers.
• The attacker can crash or degrade the LiteLLM service, disrupting AI Gateway availability for all workloads that depend on it.
• Because SC, SI, and SA are all rated High, impact extends beyond the proxy itself to any connected systems, including upstream LLM provider accounts and downstream applications consuming LiteLLM responses.