← Back

CVE-2025-0330

nvd nist
Published: Mar 20, 2025Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 3.9 / Impact: 3.6
Source: security@huntr.dev (Secondary)

Description

In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error occurs while parsing team settings. This vulnerability exposes sensitive information, including langfuse_secret and langfuse_public_key, which can provide full access to the Langfuse project storing all requests.

Affected (1)

Products: Litellm: Litellm
Litellm
1 product
Litellm
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Litellm
Version 1.52.1

Related CWEs

CWE-1230
Exposure of Sensitive Information Through Metadata
The product prevents direct access to a resource containing sensitive information, but it does not sufficiently limit access to metadata that is derived from the original, sensitive information.

References (1)

Source: security@huntr.dev
ExploitThird Party Advisory

Timeline

No history available yet.