Disclosed weakness · no CVE recorded

LiteLLM could bill team traffic to the proxy’s shared provider account

BerriAI · LiteLLM team deployment routing

First documented disclosure · Review checkpoint

Summary

A proxy-wide wildcard could take precedence over a matching team deployment and route team traffic through the shared provider credential.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The maintainer documents the behavior and correction. The sources reviewed do not establish malicious use.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

When both wildcard deployments matched, the router selected the shared deployment before the one associated with the requesting team.

Conditions required

The team uses its own provider deployment and credentials, and there is an overlapping proxy-wide wildcard. A request is made with a team key.

Potential impact

The shared provider account could incur the team’s spend. The maintainer did not report secret disclosure or access to another team’s data.

Affected versions and configurations

Affected configurations before the backport on the 1.108 LTS line. The project does not give a complete affected-version range.

Fix and mitigation status

1.108.4 LTS includes this fix. The project also merged the upstream change on its main branch.

Practical next steps

Apply the 1.108.4 LTS update or a release verified to include the routing correction. Compare proxy and provider billing for affected team configurations.

Operating lesson

Test account selection and charge attribution with overlapping routes when teams bring their own provider keys.

Evidence and limits

The October 26 pull request merged October 27. The November 9 LTS release includes the correction. No public victim or quantified billing impact was identified.

Sources