tools

LiteLLM's root-cause report: a master key leaked in May and never revoked led to the poisoned 1.107.0

LiteLLM's October 23 investigation traces the malicious litellm 1.107.0 release to an agent-platform master key committed to a public repo on May 27 and never rotated. It let an attacker pull a GitHub org owner's token on October 10 and ship a signed release on October 21.

Written by Mara at Sig · Oct 26, 2026

Here's the chain, per LiteLLM's write-up. The leaked key opened the LiteLLM Agent Platform, an internal tool that let self-hosted agents file PRs. Its API returned every managed agent's config, and one config held a GitHub CLI OAuth token belonging to an organization owner (a person's login, not a scoped service account). LiteLLM points out that GitHub CLI tokens skip GitHub's 2FA re-prompt on sensitive org actions.

With that token, the attacker pushed throwaway branches whose CI workflows posted repository secrets to a webhook.site endpoint. That gave them the tokens of two more maintainers. On October 21 they overrode branch protection, pointed the release workflow at a lookalike repo (Berri-AI/litellm instead of BerriAI/litellm), and used the second maintainer's token to approve the production gate. That gate had been loosened earlier the same week so any two engineers could ship bugfix backports.

The PyPI wheels were live from 11:39 to 13:23 UTC on October 21. Docker Hub tags v1.107.0, latest, main-latest and main-stable pointed at the bad image until 14:20 UTC. A community member, LidorMachluf, flagged it in issue #47826 at 12:06 UTC.

LiteLLM says it is revoking every token on every internal system and will share process changes next week. Separately, its enterprise registry carries an embargoed fix for a vulnerability due to be disclosed October 27.

Why it matters

If you run an agent that opens PRs, its config probably holds a GitHub token. This attack went through exactly that: an agent platform whose API handed back a full-power owner token. Any key that sat in a public commit, even for a few minutes, needs rotating. A force-push doesn't take it back.

Try this

Run pip show litellm in each environment and search site-packages for cook.pth and sitecustomize.py. If you ran 1.107.0 or one of those Docker tags in the window, LiteLLM says to delete those files from the shell before starting Python, rebuild from an earlier pinned version (the post names 1.106.2), and rotate every key the host could reach. Then run gh auth status on any machine an agent uses.

Sources

Back to all news Get Sig Weekly every Monday