{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-49468",
    "name": "CVE-2026-49468",
    "vendor": "litellm",
    "description": "A critical authentication-bypass flaw in LiteLLM versions prior to 1.84.0 stems from improper handling of Host headers in the auth layer, letting an unauthenticated attacker reach protected management endpoints under certain deployments. Exploitation requires sending crafted HTTP requests directly to a vulnerable LiteLLM proxy not protected by upstream Host-header validation.",
    "website": "https://nvd.nist.gov/vuln/detail/CVE-2026-49468",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": {
      "manager": "unknown",
      "packageName": "litellm",
      "command": null
    },
    "configFiles": null,
    "category": "package",
    "updatedAt": "2026-06-18",
    "risk": {
      "score": 90,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-49468",
      "aliases": [
        "ti-037"
      ],
      "title": "CVE-2026-49468: LiteLLM Authentication Bypass via Host Header",
      "summary": "A critical authentication-bypass flaw in LiteLLM versions prior to 1.84.0 stems from improper handling of Host headers in the auth layer, letting an unauthenticated attacker reach protected management endpoints under certain deployments. Exploitation requires sending crafted HTTP requests directly to a vulnerable LiteLLM proxy not protected by upstream Host-header validation.",
      "severity": "critical",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Authentication bypass"
      ],
      "componentType": "package",
      "component": {
        "name": "litellm",
        "vendor": null,
        "package": "litellm",
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "<1.84.0",
          "fixed": "1.84.0"
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-06-18",
      "modifiedAt": "2026-06-18",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49468"
        }
      ],
      "mitigation": "Upgrade LiteLLM to 1.84.0+. Put the proxy behind a gateway that validates/normalizes the Host header, and never expose the LiteLLM admin endpoints directly to untrusted networks.",
      "detectedByAnomity": false
    }
  }
}