LiteLLM proxy let any user self-escalate to admin, alongside a guardrail sandbox escape and template injection
Undisclosed·LiteLLM proxy (self-hosted LLM/agent gateway) — /user/update endpoint, custom-code guardrail sandbox, /prompts/test endpointFixed
LiteLLM's /user/update endpoint let an authenticated user set their own user_role field to proxy_admin, giving themselves full administrative control of the proxy; the same disclosure batch also covered a sandbox escape in LiteLLM's custom-code guardrail feature (letting user-supplied guardrail code break out of its intended isolation) and a server-side template injection in the /prompts/test endpoint.
- Blast radius
- No in-the-wild breach was disclosed; the advisories describe a vulnerability affecting all self-hosted LiteLLM proxy deployments prior to version 1.83.10. The worst of the three (CVSS 3.1: 8.8 High, C:H/I:H/A:H) lets a self-escalating user gain full admin access to all users, teams, API keys, model configs and prompt history on the proxy; exact number of affected deployments not disclosed.
- Root cause
- The self-update endpoint correctly restricted a user to editing only their own account record but did not restrict which fields could be changed, so any user able to reach it (e.g. an org_admin) could write proxy_admin into their own user_role; separately, the custom-code guardrail's execution sandbox did not fully contain user-supplied guardrail code.
- How it was caught
- Surfaced through external security research reported via the huntr bug-bounty pipeline and coordinated disclosure with the maintainers, not caught by operators running the proxy in production.
- What changed
- LiteLLM shipped patched release 1.83.10-stable closing all three issues (tracked via GitHub PR #25541 and associated commits).
Take-awayEndpoints that let users edit 'their own' record must explicitly allow-list which fields are self-editable, and any guardrail feature that runs user-supplied 'custom code' to check agent input/output needs genuine OS-level sandboxing, not just an application-layer restriction.