CVE-2026-12770

A vulnerability was determined in BerriAI litellm up to 1.63.1. The impacted element is an unknown function of the file litellm/proxy/management_endpoints/key_management_endpoints.py of the component Admin Key Handler. This manipulation causes improper authorization. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 23781. It is recommended to apply a patch to fix this issue. The vendor was contacted early about this disclosure.

• CWE-266
• CWE-285

• https://gist.github.com/YLChen-007/993c68152b2c770d53590f1684c755d4Exploit, Third Party Advisory
• https://github.com/BerriAI/litellm/Product
• https://github.com/BerriAI/litellm/pull/23781Issue Tracking, Patch
• https://vuldb.com/cve/CVE-2026-12770Third Party Advisory, VDB Entry
• https://vuldb.com/submit/811279Third Party Advisory, VDB Entry, Exploit
• https://vuldb.com/vuln/372512Third Party Advisory, VDB Entry
• https://vuldb.com/vuln/372512/ctiPermissions Required, VDB Entry

Published

Jun 21, 2026

Last Modified

Jun 24, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12755Improper input validation in the PAM AD discovery endpoints …2.7
• CVE-2026-1276IBM QRadar SIEM 7.5.0 through 7.5.0 Update Package 14 is vul…5.4
• CVE-2026-12760A denial-of-service (DoS) vulnerability has been identified …6.5
• CVE-2026-12761The miniOrange Social Login and Register (Discord, Google, T…9.8
• CVE-2026-12762IBM Cloud Pak For Business Automation 24.0.0, 24.0.1, 25.0.0…5.3
• CVE-2026-1277The URL Shortify plugin for WordPress is vulnerable to Open …4.7
• CVE-2026-12771A vulnerability was identified in BerriAI litellm up to 1.82…7.5
• CVE-2026-12772A security flaw has been discovered in BerriAI litellm up to…6.3
• CVE-2026-12773A weakness has been identified in BerriAI litellm up to 1.59…9.8
• CVE-2026-12774A security vulnerability has been detected in BerriAI litell…6.3
• CVE-2026-12775A vulnerability was detected in Montodel House-Rental-Manage…7.3
• CVE-2026-12776A flaw has been found in Montodel House-Rental-Management up…6.3