Disclosed weakness · no CVE recorded

LiteLLM WebSocket turns could miss selected guardrails

LiteLLM · LiteLLM Proxy

First documented disclosure · Review checkpoint

Summary

Later messages on an open Responses WebSocket could skip safeguards selected for that turn.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The original source establishes the weakness but does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

A long-lived Responses connection did not consistently evaluate its policies on each turn or apply a turn’s selected guardrails.

Conditions required

A deployment uses Responses WebSockets and configured guardrails across turns.

Potential impact

Requests later in the conversation or under particular provider configurations could proceed without the expected checks.

Affected versions and configurations

The affected behavior is documented. The full version range is not established.

Fix and mitigation status

1.109.0 lists this correction; other release lines may differ.

Practical next steps

Use a release containing this correction. Verify the policy on every conversational turn and after changing providers.

Operating lesson

Treat each request on a persistent connection as a new policy decision.

Evidence and limits

The project describes the correction in the linked public changes and lists it in 1.109.0. No CVE assignment or complete affected range was established.

Sources