Disclosed weakness · no CVE recorded

Deleting a LiteLLM key could leave access active on other workers

LiteLLM · LiteLLM Proxy

First documented disclosure · Review checkpoint

Summary

A deleted key could continue to authorize requests on another proxy worker until its local cache expired.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The original source establishes the weakness but does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Key deletion failed to invalidate some other workers’ cached authorization decisions.

Conditions required

A deployment has multiple workers with a previously cached key.

Potential impact

A revoked key could still authorize requests until the cached entry expired.

Affected versions and configurations

The affected behavior is documented. The full version range is not established.

Fix and mitigation status

1.109.0 lists this correction; other release lines may differ.

Practical next steps

Use a release containing this correction. Check that all workers observe revocations and audit requests made after deletion.

Operating lesson

Measure revocation across the whole deployment, not only on the worker making the change.

Evidence and limits

The project describes the correction in the linked public changes and lists it in 1.109.0. No CVE assignment or complete affected range was established.

Sources