{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0404",
  "aliases": [],
  "modified": "2026-09-20T00:00:00Z",
  "summary": "Poisoned LiteLLM releases harvest build and cloud secrets",
  "details": "## What\n\nThe 1.82.7 and 1.82.8 LiteLLM releases were described as a PyPI supply-chain compromise. The later release added a .pth startup path, while the campaign harvested cloud credentials, SSH keys, Kubernetes secrets, and gateway material. The poisoned versions are exact package identities, not a broad claim about all LiteLLM releases.\n\n## Which configuration is exposed\n\nA build or runtime environment is exposed when it installs either poisoned version from PyPI. This includes CI jobs that automatically execute Python startup hooks and agent deployments that inherit the package environment. Installation is the critical configuration signal; a clean package version is outside this record.\n\n## How ACVE detects it\n\nACVE checks a resolved PyPI LiteLLM entry for exactly 1.82.7 or 1.82.8. The matcher does not inspect a running .pth file and cannot infer secrets that were actually present. Unknown resolution remains possible.\n\n## Fix\n\nRemove both releases, rebuild from a trusted package set, and rotate cloud, SSH, Kubernetes, and API credentials available to affected jobs. Review systemd and startup paths and invalidate artifacts built during the exposure window.\n\n## Grounding needed\n\nDatadog and the vendor update should be checked for exact release scope and campaign timing. The public material supports observed malicious delivery and secret collection but not a complete victim census.\n\nThis record is limited to the condition named in the public source: Poisoned LiteLLM releases harvest build and cloud secrets. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.",
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "litellm"
      },
      "versions": [
        "1.82.7",
        "1.82.8"
      ],
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "code",
      "vulnClasses": [
        "supply-chain",
        "credential-theft"
      ],
      "cwe": [
        "CWE-522"
      ],
      "exploitation": {
        "status": "exploited-itw",
        "checkedAt": "2026-09-20T00:00:00Z",
        "sources": [
          {
            "url": "https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-teampcp-supply-chain-campaign/",
            "type": "dfir"
          },
          {
            "url": "https://docs.litellm.ai/blog/security-update-march-2026",
            "type": "vendor"
          }
        ],
        "kev": {
          "listed": false
        },
        "first_seen": "2026-03-24",
        "last_seen": "2026-03-24",
        "victims": {
          "range": "unverifiable",
          "sectors": [
            "technology"
          ],
          "evidence": "Datadog describes harvested cloud credentials, SSH keys, and Kubernetes secrets but does not establish a complete victim count."
        },
        "attribution": "TeamPCP"
      },
      "cveBoundary": "supply-chain",
      "matcher": {
        "any": [
          {
            "some": "mcpServers",
            "where": {
              "all": [
                {
                  "field": "package",
                  "op": "eq",
                  "value": "pkg:pypi/litellm"
                },
                {
                  "field": "resolvedVersion",
                  "op": "eq",
                  "value": "1.82.7"
                }
              ]
            }
          },
          {
            "some": "mcpServers",
            "where": {
              "all": [
                {
                  "field": "package",
                  "op": "eq",
                  "value": "pkg:pypi/litellm"
                },
                {
                  "field": "resolvedVersion",
                  "op": "eq",
                  "value": "1.82.8"
                }
              ]
            }
          }
        ]
      },
      "fix": {
        "summary": "Remove LiteLLM 1.82.7 and 1.82.8 and rotate harvested secrets.",
        "actions": [
          {
            "type": "remove",
            "target": "pypi:litellm@1.82.7"
          },
          {
            "type": "remove",
            "target": "pypi:litellm@1.82.8"
          }
        ]
      },
      "noCveReason": "No CVE assigned; this record describes a configuration or supply-chain condition.",
      "grounding": {
        "itw": {
          "checkedAt": "2026-09-20T16:26:22Z",
          "sources": [
            {
              "url": "https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-teampcp-supply-chain-campaign/",
              "status": 200,
              "contentType": "text/html",
              "sha256": "sha256:6ea66fcb82bfe405836ff71b2624a73adeacc1debb65f16729f5c36b529bca49",
              "type": "dfir"
            },
            {
              "url": "https://docs.litellm.ai/blog/security-update-march-2026",
              "status": 200,
              "contentType": "text/html; charset=utf-8",
              "sha256": "sha256:bce3018532416fa8d93a30cf25e0531d5c8e3274f1ac47f992bfdca39154e8cd",
              "type": "vendor"
            }
          ],
          "kev": {
            "listed": false
          }
        }
      }
    }
  }
}