CVE-2026-49468
CriticalLiteLLM: Authentication Bypass via Host Header Injection
Published Jun 16, 2026 · Updated Sep 10, 2026 · Also known as EUVD-2026-38361, GHSA-4xpc-pv4p-pm3w, PYSEC-2026-388
Key Facts
Patch in the next maintenance window- CVE-2026-49468 is a critical-severity vulnerability (CVSS 9.5 v4) affecting LiteLLM, airflow-2 (chainguard), airflow-3 (chainguard) and 1 more product.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 3.0% probability of exploitation in the next 30 days.
- Fixed versions are available, including airflow-2 2.11.2-r12, airflow-3 3.2.2-r7, airflow-3 3.3.1-r0.
- Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
CVSS v4
9.5
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS (30-day exploit likelihood)
3.0%
Higher than 87.2% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2026-49468 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, a Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes. The auth layer derived the effective route from request.url.path in litellm/proxy/auth/auth_utils.py::get_request_route(), which Starlette reconstructs from the Host header. A crafted Host could therefore make the auth gate evaluate a different route from the one FastAPI dispatched. This vulnerability is fixed in 1.84.0.
Affected Products
10 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| LiteLLMLitellm | >= < 1.84.0 | 1.84.0 |
| airflow-2chainguard | See advisory | 2.11.2-r12 |
| airflow-3chainguard | See advisory | 3.2.2-r7 |
| seal-litellmseal | See advisory | 1.80.11+sp999 |
Patched Releases
airflow-2
2.11.2-r12
airflow-3
3.2.2-r7, 3.3.1-r0
LiteLLM
1.80.11+sp999, 1.84.0
seal-litellm
1.80.11+sp999
Timeline
Publicly disclosed
Jun 16, 2026
Last updated
Sep 10, 2026
Weakness Type
- CWE-290 Authentication Bypass by Spoofing
References
- advisoryGHSA advisory
- advisoryhttps://github.com/BerriAI/litellm/releases/tag/v1.84.0
- advisoryhttps://github.com/BerriAI/litellm/security/advisories/GHSA-4xpc-pv4p-pm3w
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49468.json
- advisoryhttps://github.com/pypa/advisory-database/tree/main/vulns/litellm/PYSEC-2026-388.yaml
FAQ
Common Questions.
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format.
Affected: LiteLLM versions >= < 1.84.0; airflow-2 (chainguard); airflow-3 (chainguard), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including airflow-2 2.11.2-r12, airflow-3 3.2.2-r7, airflow-3 3.3.1-r0.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
Is CVE-2026-49468 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo