HIGH 7.5 PyPI
LiteLLM Reveals Portion of API Key via a Logging File
GHSA-g5pg-73fc-hjwq · CVE-2024-9606 · PYSEC-2026-1548
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
In berriai/litellm before version 1.44.12, the litellm/litellm_core_utils/litellm_logging.py file contains a vulnerability where the API key masking code only masks the first 5 characters of the key. This results in the leakage of almost the entire API key in the logs, exposing a significant amount of the secret key. The issue affects version v1.44.9.
Ready to move
Start Securing
Free, no credit card | First findings in minutes