# LiteLLM allowed_routes Authorization Bypass (CVE-2026-47101)

- **Severity:** Critical
- **Signature ID:** `2619d68c-e4a3-4923-9781-3400ece9093d`
- **CVEs:** CVE-2026-47101
- **MITRE ATLAS:** AML.T0049 (Exploit Public-Facing Application)
- **OWASP:** ASI03 (Identity and Impersonation), ASI06 (Goal and Instruction Manipulation), LLM06 (Excessive Agency)

## Summary

A flaw in LiteLLM's virtual-key API lets an ordinary internal user create or update an API key that includes administrative routes in its permissions list. The server does not check whether the requester is actually allowed to grant those permissions, so a low-privilege account can mint itself an admin-equivalent key.

## How the attack works

An attacker with a normal internal_user account calls one of LiteLLM's key-management endpoints (/key/generate, /key/update, /key/regenerate, or /key/service-account/generate). In the request they set the allowed_routes parameter to include administrative or management routes — such as user, key, team, or global management endpoints — or use a wildcard to cover all routes. LiteLLM does not validate this list against the caller's own role, so it issues a key that carries those elevated permissions. The attacker then uses that key to call admin-only functionality, effectively becoming a proxy_admin.

## Why it matters

An organization running an affected LiteLLM proxy can have any authenticated low-privilege user escalate to full administrative control over the proxy, including managing other users, teams, and keys — without any additional exploit step.

## What you can do

- Upgrade LiteLLM to 1.83.14 or later.
- Audit existing API keys for allowed_routes values that include administrative or wildcard routes, especially those created or updated by non-admin accounts.
- Restrict which accounts can call /key/generate, /key/update, /key/regenerate, and /key/service-account/generate until patched.
- Monitor key-management requests for allowed_routes values reaching admin/management endpoints and confirm each one was created intentionally by a proxy_admin.

## Known benign look-alikes

- A proxy_admin generating a key with broad allowed_routes intentionally — expected to match; review confirms intent.
- Security advisory or PR text quoting the CVE-2026-47101 payload.
- Key generation scoped to inference routes only (/chat/completions, /embeddings, /v1/models).

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01934
- https://nvd.nist.gov/vuln/detail/CVE-2026-47101

---
Source: https://www.netzilo.com/threats/atr-litellm-allowed-routes-authorization-bypass-cve-2026-47101