LiteLLM 主密鑰外洩 136 天未撤銷，攻擊者發布惡意 1.107.0 版本

TL;DR

what: An unrevoked LiteLLM Agent Platform master key leaked on GitHub in May 2026 let an attacker steal an org owner's GitHub token and publish a malicious LiteLLM 1.107.0 on October 21, 2026.
impact: The attacker held owner-level access to every BerriAI repository, harvested maintainer tokens plus API keys for Anthropic, OpenAI, AWS Bedrock, Together AI and more, and pushed poisoned builds to PyPI, Docker Hub and GHCR.
fix: PyPI quarantined 1.107.0, Docker Hub tags v1.107.0, latest, main-latest and main-stable were removed or repointed to verified clean images, and LiteLLM is revoking every token across its internal systems and vendor platforms.
who: Any organization that installed LiteLLM 1.107.0 or pulled the affected LiteLLM container tags on October 21, 2026, plus anyone whose inference keys pass through a LiteLLM gateway.

One secret that was flagged for revocation and never revoked gave an attacker owner-level control of the LiteLLM GitHub organization and a path to publish a malicious release of one of the most widely used open source LLM gateways. LiteLLM disclosed on October 24, 2026 that a master key for its Agent Platform, committed to a public repository on May 27, 2026, was used on October 10 to start a chain that ended with LiteLLM 1.107.0 being published to PyPI, Docker Hub and GHCR on October 21.

The release was live on PyPI for roughly an hour and 45 minutes before quarantine, and the container tags stayed poisoned for about two and a half hours. For a package that sits between applications and every upstream model provider they call, that window matters.

The Leak That Was Caught but Not Closed

On May 27, 2026, a configuration file committed to the public LiteLLM-Labs/lite-harness repository contained the master key for a deployment of the LiteLLM Agent Platform, an open source tool LiteLLM uses to orchestrate agents. The team spotted the mistake, force-pushed over the commit and marked the exposed keys for revocation. The master key was never actually revoked.

Force-pushing removes a commit from branch history, not from every clone, mirror or scraper that already captured it. The key stayed valid for 136 days until the attacker used it.

From Agent Platform to Organization Owner

On October 10, 2026, an attacker operating from 69.48.229[.]143 authenticated to the Agent Platform with the leaked key and pulled a GitHub CLI OAuth token the service used so self-hosted cloud agents could open pull requests. That token was not scoped down and belonged to the GitHub organization owner's account. It gave the attacker owner-level access to every repository in the organization.

⚠️ The core failure — An automation credential whose only job was filing pull requests carried full organization owner rights. Once the Agent Platform fell, there was no permission boundary left between the attacker and the release process.

Ghost Branches and Credential Harvesting

Between 10:11 and 10:12 p.m. UTC on October 10, the attacker pushed commits to throwaway branches on the internal BerriAI/litellm and BerriAI/litellm-auto repositories. Socket recovered two malicious commits, one on October 10 at 10:11:45 p.m. UTC and a second on October 12. Each followed the same pattern:

Create a branch named ci-tmp- (observed: ci-tmp-a351cc and ci-tmp-4d8517) from a recent legitimate commit so the base looks clean.
Push a commit adding .github/workflows/cache.yml with the subject "ci: bump cache config".
Let the on: [push] trigger run the workflow immediately.
Delete the branch, and later the workflow runs, within minutes.

Socket noted that neither commit landed on a branch that still exists, which is why ordinary repository history shows almost nothing. The evidence lived in activity logs.

The October 10 workflow harvested GitHub CLI OAuth tokens for two engineers with maintainer privileges, plus keys for the Linear workspace, a LiteLLM deployment, Together AI, and a GitHub App identifier and signing key. The October 12 run widened collection to API keys for Anthropic, OpenAI, AWS Bedrock, Tavily and the GitGuardian secret-scanning tenant, along with Playwright storage state, PostgreSQL connection strings and credentials, and Redis endpoint, port and password. Data went to two webhook[.]site endpoints.

Hijacking the Release Pipeline on October 21

LiteLLM's normal release process requires an authorized engineer to start a build and a special account tied to a physical device in the office to approve it. That week the control had been relaxed to allow any two engineers to trigger and approve releases, to support a push for more frequent releases and bugfix backports. The attacker had exactly two maintainer tokens.

10:08 to 11:08 a.m. UTC: branch protection overridden and the release pipeline source repointed to the lookalike repository Berri-AI/litellm instead of BerriAI/litellm.
11:39 to 11:40 a.m. UTC: LiteLLM 1.107.0 published to PyPI, triggered with one stolen token and approved with the other.
11:46 a.m. UTC: Docker Hub and GHCR images published.
11:53 to 11:54 a.m. UTC: production and staging run records deleted.
12:06 p.m. UTC: attack reported by Upwind researcher Lidor Machluf.
1:23 p.m. UTC: PyPI quarantines 1.107.0.
2:20 p.m. UTC: Docker Hub tags v1.107.0, latest, main-latest and main-stable removed or repointed to verified clean images.

LiteLLM pointed out that the attacker already held an owner token and could have disabled the two-person rule outright. The team suspects the attacker chose not to in order to avoid detection. Using the relaxed control as designed produced a release that looked procedurally normal.

Indicators of Compromise

Source IP: 69.48.229[.]143
Exfiltration: webhook[.]site/65a42464-3cfa-4b02-a18c-17a6d7b86f37
Exfiltration: webhook[.]site/4da03473-a3e7-4dc2-a087-9c564b4208e1
Lookalike repository: Berri-AI/litellm
Branch names: ci-tmp-a351cc, ci-tmp-4d8517
Workflow file: .github/workflows/cache.yml, commit subject "ci: bump cache config"
Malicious package: LiteLLM 1.107.0 on PyPI, Docker Hub and GHCR

Vendor Response

PyPI quarantined the release and LiteLLM repointed the affected Docker Hub tags to verified clean images. LiteLLM says it is revoking every token associated with every internal system and vendor platform. The disclosure does not detail the behavior of the code inside 1.107.0, so the full downstream impact on environments that installed it is not yet public.

RedEye assessment — Three separate controls failed in sequence: secret revocation after a known leak, least privilege on an automation token, and release approval that had been loosened days earlier. Each one alone would likely have stopped this chain. AI gateways concentrate provider keys for an entire organization, which makes the secrets they hold and the pipelines that build them high-value targets. RedEye Security can assess your exposure to this incident and review how your CI/CD and AI tooling credentials are scoped.

Originally published on RedEye Threat Intelligence.