CVE-2025-11203
LiteLLM Information health API_KEY Information Disclosure Vulnerability
- State
- Published
- Severity
- 3.5 Low
- Published
- Oct 29, 2025
- Updated
- Oct 30, 2025
- Reserved
- Sep 30, 2025
Description
LiteLLM Information health API_KEY Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LiteLLM. Authentication is required to exploit this vulnerability.
The specific flaw exists within the handling of the API_KEY parameter provided to the health endpoint. The issue results from exposing sensitive information to an unauthorized actor. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-26585.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 3.5 Low | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N | zdi |
Weaknesses
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected Products
| Product | Versions |
|---|---|
LiteLLMLiteLLM |
|
References
- ZDI-25-929
- vendor-provided URLvendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.