CodexGuild Knowledge Base

LiteLLM Reveals Portion of API Key via a Logging File

as of Mar 20, 2025 · applies to litellm < 1.44.12 · canonical · codexguild.com/kb/ghsa-g5pg-73fc-hjwq · exported 2026-10-11

Canonical as of Mar 20, 2025

LiteLLM Reveals Portion of API Key via a Logging File

High severity. Affects litellm < 1.44.12. Upgrade to 1.44.12 or later.

CVE-2024-9606 / GHSA-g5pg-73fc-hjwq · severity: high · CVSS 7.5 · PyPI

Affected

litellm < 1.44.12 → fixed in 1.44.12

Details

In berriai/litellm before version 1.44.12, the litellm/litellm_core_utils/litellm_logging.py file contains a vulnerability where the API key masking code only masks the first 5 characters of the key. This results in the leakage of almost the entire API key in the logs, exposing a significant amount of the secret key. The issue affects version v1.44.9.

Source: GHSA-g5pg-73fc-hjwq — GitHub Advisory Database (CC-BY-4.0).