CVE-2025-11203

LOW

LiteLLM Information health API_KEY Information Disclosure Vulnerability

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-11203 has a selected CVSS score of 3.5 (low); EIP currently links 1 repository PoC and 1 lab environment.

Description

LiteLLM Information health API_KEY Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LiteLLM. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of the API_KEY parameter provided to the health endpoint. The issue results from exposing sensitive information to an unauthorized actor. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-26585.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 30, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

LiteLLM

Browse LiteLLM / LiteLLM

Default status: unknown

CVE List10.2.2025affected

Proofs of concept

1

Repository PoCs

GitHublearner202649/CVE-2025-11203-PoCRepository PoCby learner2026490Scanner10 files

85.9 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a scanner that checks a LiteLLM instance for CVE-2025-11203 by querying the /health endpoint and reporting whether API keys are exposed in the response. It does not exploit the vulnerability to gain unauthorized access or exfiltrate credentials beyond what the endpoint returns.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README, an exploit script, and a requirements file for a CVE-2025-11203 proof-of-concept. The exploit script performs only the documented information disclosure against a LiteLLM /health endpoint: it authenticates, queries the endpoint, and recursively searches the JSON response for API key fields. No backdoor, persistence, credential exfiltration to an attacker-controlled host, or unrelated payload delivery is present. The script's behavior is fully transparent and matches the stated PoC purpose.

ClassificationScanner
Model confidence95%
AuthenticationRequired
LanguagesPythonMarkdown
Target softwareLiteLLM
Attack typesInformation Disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script's primary operation is to query the /health endpoint and scan the response for exposed API keys, reporting whether a leak is detected. It does not use the leaked keys to perform any further action, such as accessing other services or escalating privileges. The README describes it as a 'Proof of Concept' but the code itself only detects and reports the presence of sensitive data, which aligns with the definition of a scanner.

exploit/exploit.py:2-7exploit/exploit.py:58-79exploit/exploit.py:134-174

Requirements

  • A valid LiteLLM API key is required to authenticate to the target instance.exploit/exploit.py:10exploit/exploit.py:44
  • The target LiteLLM instance must be reachable over the network.exploit/exploit.py:27-32

Observed behavior

  • Authenticates to the target LiteLLM instance using a provided API key.exploit/exploit.py:43-46
  • Sends a GET request to the /health endpoint and parses the JSON response.exploit/exploit.py:48-50
  • Recursively scans the response for fields named api_key, apikey, api-key, secret, token, or x-api-key and reports any found values.exploit/exploit.py:58-79
  • Prints a summary indicating whether credentials were leaked and whether the target is vulnerable or fixed.exploit/exploit.py:134-174
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Target
Payload withheldDefault target for the exploit script; only connects to a user-supplied or default local address.exploit/exploit.py:185-186
Credential Search
Payload withheldThe script searches the health endpoint JSON response for fields containing these substrings to demonstrate the information disclosure vulnerability.exploit/exploit.py:68
Review boundaries

What the analysis did not establish

  • The evidence packet reports complete_artifact_coverage as false, indicating that not all files from the repository are included. Six text files and one non-text media file are omitted from the provided content.
  • The analysis is based solely on the supplied text files (README.md, exploit/exploit.py, requirements.txt) and does not include the Docker, configuration, or documentation files referenced in the repository structure.
  • 6 unclassified files and 1 non-text media file were present in the artifact but not provided as text; their content was not reviewed.
  • The analysis scope covers only the three selected text files; the remaining 7 files (including binary and unclassified content) were not analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

learner202649/CVE-2025-11203-PoCCreated Vuln labCVE-2025-11203Compose · mixed

1 Compose manifest · 1 Dockerfile · 2 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that runs a vulnerable LiteLLM instance (v1.61.0) and an optional fixed instance (v1.83.10) to demonstrate CVE-2025-11203, an information disclosure vulnerability in the /health endpoint.

docker-compose.yml:1-28README.md:1-10

Lab assessment

Vulnerability lab

The README explicitly describes the environment as a proof-of-concept for CVE-2025-11203, includes a vulnerable service, an exploit script, and a fixed service for verification.

README.md:1-10README.md:55-70
Lab shapeCompose · mixed
Services2
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

litellm-vuln

vulnerable target

A LiteLLM proxy service built from a Dockerfile that installs version 1.61.0 and patches the health check to remove 'api_key' from the illegal display parameters, causing the /health endpoint to leak configured API keys.

docker-compose.yml:4-13litellm-vuln/Dockerfile:1-11

litellm-fixed

fixed reference

A LiteLLM proxy service using a pre-built image (v1.83.10) that sanitizes API keys from the /health response, serving as a non-vulnerable comparison. It is only started when the 'fixed' profile is activated.

docker-compose.yml:16-28

exploit.py

exploit script

A Python script that authenticates to the LiteLLM /health endpoint, retrieves the response, and recursively searches for leaked API keys. It supports both vulnerable and fixed targets and provides verbose output.

exploit/exploit.py:1-199

litellm_config.yaml

configuration

A configuration file mounted into both services that defines three model entries with fake API keys, which are expected to be leaked by the vulnerable service.

litellm_config.yaml:1-16
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-11203

Supported by supplied evidence

The README, Dockerfile, and exploit script all explicitly reference CVE-2025-11203, describe the vulnerability (API key leak via /health in LiteLLM < 1.63.14), and provide a working proof-of-concept.

README.md:1-10litellm-vuln/Dockerfile:3-5exploit/exploit.py:1-6
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to run the services.README.md:55-57
  • Python 3 and the 'requests' library (from requirements.txt) are needed to run the exploit script.README.md:59-60requirements.txt:1
  • The vulnerable LiteLLM service must be running and accessible at the target URL (default http://localhost:4000).README.md:55-57exploit/exploit.py:30-34
  • A valid LiteLLM master key (default 'sk-litellm-master-key') is required to authenticate to the /health endpoint.docker-compose.yml:10exploit/exploit.py:45-48

Evidence-described exercise path

  1. Start the vulnerable LiteLLM service using 'docker compose up -d'.README.md:55-57
  2. Install Python dependencies with 'pip install -r requirements.txt'.README.md:59-60
  3. Run the exploit script against the vulnerable target: 'python3 exploit/exploit.py --target http://localhost:4000 --key sk-litellm-master-key'.README.md:62-63
  4. Observe leaked API keys in the output, confirming the vulnerability.README.md:72-100
  5. (Optional) Start the fixed service with 'docker compose --profile fixed up -d' and run the exploit with '--fixed' to verify the fix.README.md:66-68
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the contained lab target (the LiteLLM /health endpoint). The exploit script only reads from the target service and prints results; it does not modify the host, connect to external systems, persist data, or perform any destructive actions. The Docker Compose configuration uses standard port mappings and bind mounts without privileged mode, and no hidden or unnecessary behavior is present.

exploit/exploit.py:1-199docker-compose.yml:1-28
Review boundaries

What the analysis did not establish

  • The packet includes a binary file (result.png) that is not inspected; its content is unknown.
  • The Dockerfile for the vulnerable service uses a sed patch to intentionally reintroduce the vulnerability, which is a lab-specific modification and not representative of the original unpatched software behavior.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

3