CVE-2026-49468
Vulnerability in Litellm
CVSS score
9.8
EPSS probability
%3.0
Risk score
0.3
Published
3 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
CVE-2026-49468 — LiteLLM (<1.84.0) unauthenticated auth bypass via Host-header route confusion. PoC + docker lab.
Makefile Go / Python
Nuclei: LiteLLM Proxy < 1.84.0 - Host Header Authentication Bypass
Makefile Go / Python
Similar Vulnerabilities
8.8
CVE-2026-42271 Actively exploited
Command injection in Litellm
L
Patch verified Public Exploits:3EPSS %93
9.8
CVE-2026-42208 Actively exploited
SQL injection in Litellm
L
Patch verified Public Exploits:1EPSS %6
8.8
CVE-2026-35029
Incorrect authorization in Litellm
L
Patch status unknown Public Exploits:2EPSS %4
8.8
CVE-2026-40217
Code injection in Litellm
L
Patch status unknown Public Exploits:3EPSS %3
8.8
CVE-2026-59822 Actively exploited
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
B
Patch verified Public Exploits:1EPSS %1
8.7
CVE-2026-47101
LiteLLM < 1.83.14 Privilege Escalation via API Key Generation
B
Patch verifiedEPSS %1
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-49468"