A critical unauthenticated Remote Code Execution vulnerability has been discovered in LiteLLM, the widely-deployed open-source AI API gateway that routes requests between applications and major AI providers including OpenAI, Anthropic, Google, and dozens of others. The vulnerability, which requires no authentication to exploit, effectively allows any attacker with network access to the LiteLLM instance to execute arbitrary commands on the host system with the full permissions of the gateway process.

LiteLLM has become critical infrastructure in countless AI deployments. The gateway provides a unified API interface that allows organizations to route AI requests to different providers, implement usage policies and rate limiting, centralize billing, and maintain audit logs. Its architecture means that a compromised LiteLLM instance sits at the intersection of an organization's internal systems and multiple external AI provider accounts — making it an extraordinarily high-value target.

The CISA Vulnerability Exploitability Exchange (KEV) catalog has listed the vulnerability for immediate attention, indicating that exploitation has been observed in the wild. Organizations running LiteLLM instances — which the project's documentation indicates has been deployed in thousands of enterprise environments — are urged to apply patches immediately or implement network controls restricting access to LiteLLM management interfaces while patches are applied.

The potential consequences of exploitation are severe across multiple dimensions. Attacker access to the LiteLLM host could enable direct exfiltration of AI provider API keys managed by the gateway, giving attackers the ability to make API calls at the victim organization's expense and potentially access data processed through the gateway. It could also enable modification of routing rules to redirect AI queries to attacker-controlled endpoints, poisoning AI responses delivered to users. In environments where LiteLLM has connectivity to internal services, it could serve as an initial compromise point for broader network intrusion.

This vulnerability arrives amid growing concern about the security of AI infrastructure components more broadly. The rapid adoption of AI tools has generated a parallel ecosystem of AI infrastructure software — gateways, orchestration frameworks, model serving platforms — that has not always received the same security scrutiny as more mature software categories. Security researchers and organizations should be conducting comprehensive audits of their AI infrastructure deployments to identify similar vulnerabilities before they are discovered and exploited by adversaries.