Disclosed weakness · no CVE recorded

An empty deployment key could expose the proxy’s OpenAI administrator key

LiteLLM · LiteLLM proxy with OpenAI Python SDK 3.x

First documented disclosure · Review checkpoint

Summary

A misconfigured deployment could send an organization administrator credential to its configured compatible endpoint instead of refusing the request.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The maintainer documented the credential-handling behavior. No malicious recipient or subsequent key use was established.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

An SDK credential fallback selected the administrator key when the deployment lacked its own key.

Conditions required

The proxy used the version-three OpenAI SDK, had an administrator key in its environment, and sent a request through an affected deployment with an empty key. The upstream destination determined who received it.

Potential impact

The endpoint operator could receive an administrator credential. The sources do not report unauthorized use of an organization account.

Affected versions and configurations

Affected configuration before the change. The maintainer distinguishes the version-three SDK path from the older version-two path; the earliest affected LiteLLM package is not stated.

Fix and mitigation status

The fix merged November 5 and is explicitly listed in 1.108.2 LTS, released November 6.

Practical next steps

Upgrade the affected deployment, keep organization administrator credentials out of proxy environments that do not need them, and rotate the key if affected requests reached an untrusted endpoint.

Operating lesson

A missing low-privilege credential should fail the request rather than fall back to a more powerful one.

Evidence and limits

The PR is the earliest specific disclosure located; the later LTS release documents inclusion. No CVE identity or CVSS score was verified.

Sources