# LiteLLM

Open-source AI gateway and Python SDK that puts 100+ LLM providers behind one OpenAI-format API

**Verdict: conditional.** LiteLLM is a strong free default for putting many model providers behind one OpenAI-format API on your own infrastructure, with virtual keys, budgets, load balancing and guardrails in the open-source plan. Conditional on security discipline: a PyPI supply-chain compromise, an MCP authentication bypass exploited in the wild, and on September 30, 2026 a critical advisory (CVSS 9.9) that lets an internal user forge proxy admin credentials. Right for platform teams that pin versions, patch within days and harden deployments. Last verified 2026-10-29.

LiteLLM is an open-source AI gateway from BerriAI that gives applications one OpenAI-format interface to many model providers. Its docs describe two ways to use it: a Python SDK with a single completion() interface, built-in retry and fallback logic, and observability callbacks, and a self-hosted Proxy Server (LLM Gateway) for platform teams with virtual keys and budgets, centralized logging, guardrails, caching and an admin UI. The docs and README say 100+ providers, including OpenAI, Anthropic, Vertex AI and Bedrock; LiteLLM's site claims 140+ providers and 1,800+ models, support for agents and MCP servers, load balancing across providers and regions, and self-hosted deployment via Docker, Helm charts or Terraform, including air-gapped. The code is MIT licensed, except the enterprise/ directory, which carries its own licence. LiteLLM Enterprise adds SSO and SCIM, audit logs and 24/7 support with response-time SLAs; its price is set through sales, and a 30-day self-hosted trial key is emailed with no sales call and no credit card. Its security history matters for anyone deploying it. On March 24, 2026, compromised PyPI releases 1.82.7 and 1.82.8 were live for about 40 minutes by LiteLLM's account, which says customers on the official Proxy Docker image were not affected. CVE-2026-59822, an MCP authentication bypass fixed in v1.84.0, and CVE-2026-59821, a post-auth remote code execution through custom code guardrails fixed in v1.82.0, were published on July 8, 2026, according to the disclosure timeline in Wiz's September 9, 2026 research, which also reports CVE-2026-59822 exploited in the wild and added to CISA's Known Exploited Vulnerabilities catalog on September 2, 2026. LiteLLM's own security posts list two earlier proxy CVEs: CVE-2026-30623 (April 21, 2026), a command injection through Anthropic's MCP SDK that allowed authenticated remote code execution over the MCP stdio transport, fixed in v1.83.7-stable or later, and CVE-2026-42208 (April 29, 2026), a SQL injection in the proxy's API key verification path, fixed in v1.83.10-stable. On September 30, 2026 LiteLLM published GitHub advisory GHSA-7hp6-4w63-5g45, rated critical (CVSS 9.9, no CVE assigned): privilege escalation to proxy admin through cross-domain reuse of the salt key, where an authenticated internal user crafts a metadata field when requesting an API key, obtains a forged admin token and can then execute commands through the MCP stdio endpoint. It is patched in 1.100.4, 1.101.3, 1.102.2, 1.103.1 and 1.104.0rc2; the stated workaround, EXPERIMENTAL_UI_LOGIN=false, disables CLI SSO and Claude Code gateway login. On October 1, 2026 LiteLLM published a second GitHub advisory, GHSA-g5ff-637f-6q2m, rated high (CVSS 8.1, no CVE assigned): an authenticated user with internal_user_viewer privileges could bypass the request-body blocklist, which rejected vertex_credentials but overlooked its alias vertex_ai_credentials, and read arbitrary files from the proxy runtime through the /utils/transform_request endpoint, exposing environment variables and API keys that could lead to full proxy admin control. Versions before 1.95.0 are affected, 1.95.0 is the patched version, and the advisory states there is no reliable configuration workaround on affected versions. On October 21, 2026 LiteLLM's own release pipeline was compromised a second time. By LiteLLM's incident post, an attacker with stolen GitHub credentials modified the release workflow and published v1.107.0 from a lookalike repository (Berri-AI/litellm instead of BerriAI/litellm); the release contained compiled malware that steals credentials and loads remote-code execution tools. It was live on PyPI for about two hours (11:39:51 to 13:23 UTC) and the Docker tags v1.107.0, latest, main-latest and main-stable were compromised from 11:46:56 to 14:20 UTC, so, unlike in March, Docker proxy users running those tags were affected. LiteLLM's October 23 write-up traces the breach to an administrative key committed to the public LiteLLM-Labs/lite-harness repository on May 27, 2026, deleted three hours later but valid for over four months, which led to three stolen GitHub CLI OAuth tokens. Affected users are told to delete cook.pth, cook.py and sitecustomize.py from site-packages, kill the detached Python daemon, reinstall pinned to 1.106.2 or rebuild, and rotate every credential the host could reach; enterprise customers on LiteLLM's private registry were unaffected. On October 27, 2026 LiteLLM announced that private registry as a way to distribute fixes for its most severe vulnerabilities privately before public release; it currently serves enterprise customers in a pilot and OSS access is under evaluation. The same day it published GHSA-w4c7-34wj-hqm8, rated critical (CVSS 10.0, no CVE assigned): unauthenticated requests to a proxy with Enterprise licensing can make it read a local file such as /proc/self/environ and send the contents to an attacker-chosen URL, exposing LITELLM_MASTER_KEY and provider credentials. It is patched in 1.103.10, 1.104.8, 1.105.6 and 1.106.5, with WAF filtering of the named request-body parameters and restricted outbound network access as interim mitigations.

## Strengths

- Calling many model providers through one interface: LiteLLM's docs describe a single OpenAI-format API across 100+ LLMs, including OpenAI, Anthropic, Vertex AI and Bedrock
- Platform teams controlling spend and access, with virtual keys, budgets, teams and RPM/TPM limits included in the free open-source plan
- Keeping model traffic inside your own infrastructure, with self-hosted deployment via Docker, Helm charts or Terraform, including air-gapped
- Resilient routing, with built-in retry and fallback logic in the SDK Router and load balancing across providers and regions
- Trying enterprise features before buying: a 30-day self-hosted Enterprise trial key is emailed with no sales call and no credit card
- Deployments left on defaults: Wiz says the master key is still set by default to sk-1234 on Docker compose and pip installs, and nearly 1 in 10 of 3,074 publicly exposed deployments it scanned in February 2026 accepted a default master key or required no authentication
- Unpinned pip installs: compromised PyPI releases 1.82.7 and 1.82.8 were live on March 24, 2026, and LiteLLM told affected users to rotate all secrets
- Auto-pulling the newest release: v1.107.0 was malware on October 21, 2026, live on PyPI for about two hours and on the latest and main-latest Docker tags until 14:20 UTC; pin a reviewed version, delay upgrades and rotate every secret if you pulled it
- Internet-facing proxies nobody keeps patched: per Wiz, CVE-2026-59822, an MCP authentication bypass fixed in v1.84.0, has been exploited in the wild and added to CISA's Known Exploited Vulnerabilities catalog, and CVE-2026-59821, a post-auth RCE through custom code guardrails, was fixed in v1.82.0
- Proxies with untrusted internal users on unpatched builds: GHSA-7hp6-4w63-5g45 (CVSS 9.9, published September 30, 2026) lets an authenticated internal user forge a proxy admin token and reach the MCP stdio endpoint; upgrade to 1.100.4, 1.101.3, 1.102.2, 1.103.1 or 1.104.0rc2
- Enterprise-licensed proxies on builds older than 1.103.10, 1.104.8, 1.105.6 or 1.106.5: GHSA-w4c7-34wj-hqm8 (CVSS 10.0, published October 27, 2026) lets unauthenticated requests read local files and leak the master key
- Buyers who need published enterprise pricing, since LiteLLM Enterprise is priced through sales

## Pricing

- Model: open-source
- Open Source: $0
- Enterprise: Custom

Website: https://www.litellm.ai

## Sources

- [LiteLLM licence (official)](https://raw.githubusercontent.com/BerriAI/litellm/main/LICENSE)
- [LiteLLM GitHub advisory GHSA-g5ff-637f-6q2m](https://github.com/BerriAI/litellm/security/advisories/GHSA-g5ff-637f-6q2m)
- [LiteLLM GitHub repository, README (official)](https://github.com/BerriAI/litellm)
- [LiteLLM website (official)](https://www.litellm.ai/)
- [Wiz Research: Off Guard, Breaking LiteLLM from authentication bypass to cloud compromise (Sep 9, 2026)](https://www.wiz.io/blog/off-guard-breaking-litellm-from-authentication-bypass-to-cloud-compromise)
- [LiteLLM, Security Update: Suspected Supply Chain Incident (official)](https://docs.litellm.ai/blog/security-update-march-2026)
- [LiteLLM docs, overview (official)](https://docs.litellm.ai/docs/)
- [LiteLLM GitHub advisory GHSA-7hp6-4w63-5g45](https://github.com/BerriAI/litellm/security/advisories/GHSA-7hp6-4w63-5g45)
- [LiteLLM Enterprise (official)](https://www.litellm.ai/enterprise)
- [LiteLLM blog](https://docs.litellm.ai/blog)
- [LiteLLM GitHub advisory GHSA-w4c7-34wj-hqm8](https://github.com/BerriAI/litellm/security/advisories/GHSA-w4c7-34wj-hqm8)
- [LiteLLM, Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised (official)](https://docs.litellm.ai/blog/security-incident-oct-21-2026)
- [LiteLLM, The attack chain behind the v1.107.0 LiteLLM release (official)](https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain)
- [LiteLLM, Introducing the LiteLLM Private Registry (official)](https://docs.litellm.ai/blog/litellm-private-registry)

Canonical: https://neomanex.com/directory/litellm