UpHeron
All vulnerabilities

Servers and applications

GHSA-2rwg-2wh4-7c4f

Authenticated secret exfiltration via Azure Entra credential parameters in the request body

Severity
High 7.7
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
1.106.9, 1.108.6, 1.109.1, 1.110.0-rc.2
Weakness
Incomplete deny list (CWE-184)Information exposure through error messages (CWE-209)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Sources
Project advisories (GitHub)

Description

This vulnerability affects only deployments with at least one Azure OpenAI (azure/) or Azure AI (azure_ai/) model, and which do not have AZURE_API_KEY or AZURE_OPENAI_API_KEY environment variables set.

The request body blocklist in the LiteLLM proxy does not cover the Azure Entra ID credential parameters (tenant_id, client_id, client_secret, azure_username, azure_password and azure_scope). An authenticated caller can send them in a normal POST /v1/chat/completions or POST /v1/images/generations body for an Azure deployment, and the values override the Azure credential the deployment would otherwise use. A caller can set the request's client_id to a reference that points at a server-side environment variable, such as LITELLM_MASTER_KEY. Entra then rejects the resolved value as an unknown application and the proxy returns that error to the caller with the resolved value in it.

From BerriAI/litellm's security advisory. Shortened; the full text is there.

Workarounds

  • Block the six parameters in request bodies at a reverse proxy or API gateway in front of LiteLLM.
Workarounds as given by BerriAI/litellm's security advisory.

Affected software

SoftwareAffected versions
LiteLLMServers and applications · github:berriai/litellm
  • Every version before 1.106.9
  • Every version before 1.108.6
  • Every version before 1.109.1
  • Every version before 1.110.0-rc.2

References