CVE-2024-9606: LiteLLM Reveals Portion of API Key via a Logging File

March 20, 2025

In berriai/litellm before version 1.44.12, the litellm/litellm_core_utils/litellm_logging.py file contains a vulnerability where the API key masking code only masks the first 5 characters of the key. This results in the leakage of almost the entire API key in the logs, exposing a significant amount of the secret key. The issue affects version v1.44.9.

References

github.com/BerriAI/litellm
github.com/advisories/GHSA-g5pg-73fc-hjwq
github.com/berriai/litellm/commit/9094071c4782183e84f10630e2450be3db55509a
huntr.com/bounties/4a03796f-a8d4-4293-84ef-d3959456223a
nvd.nist.gov/vuln/detail/CVE-2024-9606

Code Behaviors & Features

Detect and mitigate CVE-2024-9606 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →