# CVE-2026-49468: CVE-2026-49468: LiteLLM Authentication Bypass via Host Header

> CVE-2026-49468 is a critical-severity authentication bypass issue in litellm, a package. Affected: <1.84.0. Fixed in 1.84.0.

- **Canonical URL:** https://catalog.anomity.ai/vuln/cve-2026-49468
- **Aliases:** ti-037
- **Severity:** critical
- **Attack type:** Authentication bypass
- **Component:** litellm (package)
- **Package:** litellm
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-06-18
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/cve-2026-49468

## Summary

A critical authentication-bypass flaw in LiteLLM versions prior to 1.84.0 stems from improper handling of Host headers in the auth layer, letting an unauthenticated attacker reach protected management endpoints under certain deployments. Exploitation requires sending crafted HTTP requests directly to a vulnerable LiteLLM proxy not protected by upstream Host-header validation.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| <1.84.0 | 1.84.0 |

## Am I affected by CVE-2026-49468?

You are affected if you run litellm <1.84.0. Versions 1.84.0 and later include the fix.

## How do I fix CVE-2026-49468?

Upgrade LiteLLM to 1.84.0+. Put the proxy behind a gateway that validates/normalizes the Host header, and never expose the LiteLLM admin endpoints directly to untrusted networks.

## References

- cve: https://nvd.nist.gov/vuln/detail/CVE-2026-49468

## Related vulnerabilities

- [CVE-2026-114612](https://catalog.anomity.ai/vuln/cve-2026-114612) — critical
- [litellm-1-107-0-compromised-on-pypi-and-docker-a-cook-pth-startup-hook](https://catalog.anomity.ai/vuln/litellm-1-107-0-compromised-on-pypi-and-docker-a-cook-pth-startup-hook) — critical
- [CVE-2026-59822](https://catalog.anomity.ai/vuln/cve-2026-59822) — critical
- [GHSA-rqfc-q7j9-5v59](https://catalog.anomity.ai/vuln/ghsa-rqfc-q7j9-5v59) — critical
- [CVE-2026-44338](https://catalog.anomity.ai/vuln/cve-2026-44338) — critical
- [GHSA-53mr-w429-c597](https://catalog.anomity.ai/vuln/ghsa-53mr-w429-c597) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=cve-2026-49468