# Four Chained Exploit Paths in LiteLLM Proxy (Pre-Auth RCE to Master Key Exfiltration) — STAR Labs Pwn2Own Research

> STAR Labs researchers (Shi Weiming, Bruce Chen) built four distinct exploit chains against successive BerriAI LiteLLM proxy releases (1.82.3, 1.83.7, 1.83.10, 1.83.14) for Pwn2Own Berlin 2026's Local Inference category: an unauthenticated RCE chain (DB-unavailability auth bypass + Jinja2 SSTI + custom-guardrail sandbox escape), a post-auth privilege-escalation chain (metadata field-nesting + prefix-matched route bypass to proxy_admin), an unauthenticated credential-harvesting flaw in the onboarding token endpoint, and a stored os.environ reference-resolution bug that exfiltrated the LiteLLM master key through the Langfuse passthrough route.

- **Published:** 2026-07-19T00:00:00Z
- **Last reviewed:** 2026-07-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1540
- **ID:** TL-2026-1540
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-30623

## Description

On May 29, 2026 STAR Labs (Shi Weiming, Bruce Chen) published 'Race Against The Patch,' detailing four exploit chains they developed against BerriAI's LiteLLM AI-gateway proxy while preparing for the Local Inference category at Pwn2Own Berlin 2026. Each chain targeted a different release train (1.82.3, 1.83.7, 1.83.10, 1.83.14) as BerriAI shipped fixes within 4-9 days of each report, forcing the researchers to repeatedly re-pivot before the live contest.

Chain 1 (v1.82.3) achieved unauthenticated remote code execution by first flooding DB-touching auth endpoints with fabricated API keys to exhaust LiteLLM's 10-connection Prisma pool. When `allow_requests_on_db_unavailable=True`, the resulting PrismaError caused the auth handler to fall back to an implicit PROXY_ADMIN identity without key validation. With admin privileges obtained for free, the attacker generated a new admin key and injected a Jinja2 Server-Side Template Injection payload into the `/prompts/test` endpoint's `dotprompt_content` field (e.g. `{{ cycler.__init__.__globals__.os.popen('id').read() }}`), which is rendered via `jinja_env.from_string(...).render(...)` without restricting Python object traversal. A parallel path abused a custom-code guardrail sandbox: coroutine objects leaked the real `__builtins__` via `cr_frame.f_builtins`, letting an attacker recover `__import__("os")` despite a denylist, achieving sandbox escape.

Chain 2 (v1.83.7) was a post-authentication privilege-escalation-to-RCE path. LiteLLM's premium-feature gate checked `allowed_passthrough_routes` only at the top level of a key's configuration, but the field was honored when nested inside the untyped `metadata` dict, bypassing the premium check entirely. A route-authorization gate then used naive prefix matching, so an entry of `/user` granted access to any `/user/*` path including ones that shouldn't be reachable. Combined with a missing field-level filter on the `/user/update` self-update endpoint, a low-privileged internal user could set their own `user_role` to `proxy_admin`, then create a malicious MCP stdio server (`python3 -c "<payload>"`) and trigger subprocess execution by invoking the server's health/test endpoint.

Chain 3 (v1.83.10) reused Chain 2's role-escalation primitives to add the built-in `default_user_id` (a proxy_admin account) to an attacker-controlled team, then exploited a completely unauthenticated `/onboarding/get_token` endpoint: given only a public `invite_link` UUID, it returned a JWT embedding the invitee's full API key and inherited role, with no authentication dependency at all. A user-object cache TTL of roughly 60 seconds meant the attacker had to wait for the team-membership update to propagate before the authorization check would recognize the added admin, after which the JWT could be decoded to recover a live proxy_admin API key and again used to spin up an RCE-capable MCP stdio server.

Chain 4 (v1.83.14) targeted the LiteLLM master key itself. The `AddTeamCallback.validate_callback_vars` validator accepted callback metadata values shaped like `os.environ/LITELLM_MASTER_KEY` and stored them verbatim in the database without validation. A prior patch (commit df75e79615, April 13) had blocked this exact env-variable-reference pattern for real-time request bodies via `initialize_standard_callback_dynamic_params`, but the storage path used by `/key/generate` metadata went through an entirely different, unpatched validator. By setting a key's Langfuse callback metadata to `"langfuse_secret_key": "os.environ/LITELLM_MASTER_KEY"` with `"langfuse_host": "https://httpbin.org"`, then sending a request to `/langfuse/anything`, LiteLLM resolved the environment reference to the actual master key and forwarded it inside a Basic-auth Authorization header to httpbin's echo endpoint, which reflected the header back in its response body — letting the attacker base64-decode it to recover the master key in plaintext. Notably, the actual Pwn2Own Berlin 2026 contest build (v1.83.14-stable.patch.3, used May 8) shipped WITHOUT the intended fix (commit f2f1e3a0ba), though a separate, unrelated change had blocked MCP server creation without a valid cookie session; the researchers adapted live by using the leaked master key to log into the LiteLLM WebUI, capture an authenticated session cookie, and create the MCP stdio server that way.

All four chains were reported to and patched by BerriAI within 4-9 days of disclosure. The article explicitly notes no CVE numbers were assigned to these four specific chains; it references two unrelated, separately-tracked LiteLLM vulnerabilities for context — CVE-2026-30623 (MCP stdio command injection, GHSA-v4p8-mg3p-g94g) and CVE-2026-42208 (pre-auth SQL injection in proxy API key verification, GHSA-r75f-5x8p-qvmc, CVSS 9.3, exploited in the wild against `litellm_credentials`/`litellm_config` tables within 36 hours of disclosure). LiteLLM was independently exploited by three separate teams at Pwn2Own Berlin 2026, each chaining trust-boundary bugs (including SSRF and code injection variants) against the proxy to reach root-level code execution, underscoring systemic risk in AI-gateway trust assumptions around database availability, metadata parsing, onboarding flows, and secret-reference resolution.

## MITRE ATT&CK

- T1595 Active Scanning
- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1078 Valid Accounts
- T1211 Exploitation for Stealth
- T1140 Deobfuscate/Decode Files or Information
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1110 Brute Force
- T1518 Software Discovery
- T1087 Account Discovery
- T1213 Data from Information Repositories
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel

## Sources

- [Race Against The Patch: The Evolution of Four Exploit Chains in LiteLLM](https://starlabs.sg/blog/2026/05-race-against-the-patch-the-evolution-of-four-exploit-chains-in-litellm/)
- [Security Update: CVE-2026-30623 — Command Injection via Anthropic's MCP SDK](https://docs.litellm.ai/blog/mcp-stdio-command-injection-april-2026)
- [NVD - CVE-2026-30623](https://nvd.nist.gov/vuln/detail/CVE-2026-30623)
- [Authenticated command execution via MCP stdio test endpoints (GHSA-v4p8-mg3p-g94g)](https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g)
- [SQL injection in Proxy API key verification (GHSA-r75f-5x8p-qvmc)](https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc)
- [Security Update: CVE-2026-42208 in LiteLLM Proxy](https://docs.litellm.ai/blog/cve-2026-42208-litellm-proxy-sql-injection)
- [LiteLLM CVE-2026-42208 SQL Injection Exploited within 36 Hours of Disclosure](https://thehackernews.com/2026/04/litellm-cve-2026-42208-sql-injection.html)
- [CVE-2026-42208: LiteLLM Proxy Server SQL Injection Flaw](https://www.sentinelone.com/vulnerability-database/cve-2026-42208/)
- [CVE-2026-42208: Pre-Authentication SQL Injection in LiteLLM Proxy](https://bishopfox.com/blog/cve-2026-42208-pre-authentication-sql-injection-in-litellm-proxy)
- [CVE-2026-42208: Targeted SQL injection against LiteLLM's authentication path discovered 36 hours following vulnerability disclosure](https://www.sysdig.com/blog/cve-2026-42208-targeted-sql-injection-against-litellms-authentication-path-discovered-36-hours-following-vulnerability-disclosure)
- [BerriAI LiteLLM Security Advisory: 5 New Vulnerabilities Disclosed — Authentication Bypass and API Key Exposure](https://threat-modeling.com/berriai-litellm-new-cves-june-2026-authentication-api-key/)
- [MCP STDIO Design Flaw Enables Systemic AI Supply Chain RCE](https://labs.cloudsecurityalliance.org/research/csa-research-note-mcp-rce-design-vulnerability-20260423-csa/)
- [Pwn2Own Berlin 2026, 47 Zero-Days and the New AI Toolchain Attack Surface](https://www.penligent.ai/hackinglabs/pwn2own-berlin-2026-47-zero-days/)
- [BerriAI/litellm Security Advisories](https://github.com/BerriAI/litellm/security/advisories)
- [Anthropic MCP Design Vulnerability Enables RCE, Threatening AI Supply Chain](https://thehackernews.com/2026/04/anthropic-mcp-design-vulnerability.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1540