CVE-2026-47102: LiteLLM self-service user update allows changing own user_role via /user/update

Summary

LiteLLM versions prior to 1.83.10 let a user change their own user_role through the /user/update endpoint. The endpoint limits updates to the caller's own account but does not restrict which fields can be changed, so a user can set their role to proxy_admin and gain full administrative access, including all users, teams, keys, models, and prompt history. Users with the org_admin role can exploit this without chaining any additional flaw.

Mitigation

Fixed in 1.83.10.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• litellmPyPILLM dependency since 2023-07-27 · 54 tracked dependents

Related items

• MediumWhen LLM Gateways Go Wrong: Findings from LiteLLMSimilar attack · Check Point Research
• HighCVE-2026-109403: conductor-oss conductor server-side request forgery in agent card fetchingSimilar attack · NVD/CVE Database
• InfoExploring Backdoor Vulnerabilities and Fairness Challenges in Generative Models: A SurveySimilar attack · ACM Digital Library (TOPS, DTRAP, CSUR)
• LowSmall AI Models Could Soon Self-Replicate on IoT Devices, Anthropic WarnsSimilar attack · SecurityWeek
• MediumCVE-2026-108940: Mistral.rs path traversal through calibration_apply save_cimatrix argumentSimilar attack · NVD/CVE Database