ACVE-2026-0404

In the wild

exploited-itw · 2026-03-24 – 2026-03-24 · dfir, vendor

Description

What

The 1.82.7 and 1.82.8 LiteLLM releases were described as a PyPI supply-chain compromise. The later release added a .pth startup path, while the campaign harvested cloud credentials, SSH keys, Kubernetes secrets, and gateway material. The poisoned versions are exact package identities, not a broad claim about all LiteLLM releases.

Which configuration is exposed

A build or runtime environment is exposed when it installs either poisoned version from PyPI. This includes CI jobs that automatically execute Python startup hooks and agent deployments that inherit the package environment. Installation is the critical configuration signal; a clean package version is outside this record.

How ACVE detects it

ACVE checks a resolved PyPI LiteLLM entry for exactly 1.82.7 or 1.82.8. The matcher does not inspect a running .pth file and cannot infer secrets that were actually present. Unknown resolution remains possible.

Fix

Remove both releases, rebuild from a trusted package set, and rotate cloud, SSH, Kubernetes, and API credentials available to affected jobs. Review systemd and startup paths and invalidate artifacts built during the exposure window.

Grounding needed

Datadog and the vendor update should be checked for exact release scope and campaign timing. The public material supports observed malicious delivery and secret collection but not a complete victim census.

This record is limited to the condition named in the public source: Poisoned LiteLLM releases harvest build and cloud secrets. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.

Configuration

or
  some mcpServers where
    and
      package eq "pkg:pypi/litellm"
      resolvedVersion eq "1.82.7"
  some mcpServers where
    and
      package eq "pkg:pypi/litellm"
      resolvedVersion eq "1.82.8"

Fix

Remove LiteLLM 1.82.7 and 1.82.8 and rotate harvested secrets.

• Remove pypi:litellm@1.82.7.
• Remove pypi:litellm@1.82.8.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

No references recorded.