Testbeds for CVE-2026-49468-litellm

litellm/CVE-2026-49468/README.md

@@ -0,0 +1,28 @@
+# Host Header Authentication Bypass affecting LiteLLM proxy (CVE-2026-49468)
+
+LiteLLM proxy versions v1.83.9 and earlier are susceptible to an authentication bypass via Host header route confusion. A remote unauthenticated attacker can supply a crafted Host header containing a fragment or control sequence (such as #@) to bypass authorization gates and access sensitive administrative endpoints like /key/generate.
+
+## Vulnerable Version
+
+### Setup
+
+Start the vulnerable LiteLLM proxy instance (v1.82.0-stable) with its PostgreSQL database on port 4000:
+
+```sh
+docker compose up -d litellm-vuln
+```
+## Safe Version
+
+### Setup
+
+Start the patched LiteLLM proxy instance (v1.84.0) with its PostgreSQL database on port 4001:
+```sh
+
+docker compose up -d litellm-patched
+```
+
+
+
+
+
+

litellm/CVE-2026-49468/config.yaml

@@ -0,0 +1,5 @@
+model_list:
+  - model_name: gpt-3.5-turbo
+    litellm_params:
+      model: openai/gpt-3.5-turbo
+      api_key: fake-openai-key

litellm/CVE-2026-49468/docker-compose.yml

@@ -0,0 +1,64 @@
+services:
+  db:
+    image: postgres:15-alpine
+    container_name: litellm-db
+    environment:
+      POSTGRES_USER: litellm
+      POSTGRES_PASSWORD: litellm
+      POSTGRES_DB: litellm
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U litellm -d litellm"]
+      interval: 5s
+      timeout: 3s
+      retries: 30
+    restart: unless-stopped
+
+  # --- VULNERABLE PROXY (Port 4000) ---
+  litellm-vuln:
+    image: ghcr.io/berriai/litellm:v1.82.0-stable
+    container_name: litellm-proxy-vuln
+    depends_on:
+      db:
+        condition: service_healthy
+    environment:
+      PYTHONOPTIMIZE: "1"
+      DATABASE_URL: postgresql://litellm:litellm@db:5432/litellm
+      STORE_MODEL_IN_DB: "True"
+      LITELLM_MASTER_KEY: sk-local-master-vuln
+    ports:
+      - "4000:4000"
+    volumes:
+      - ./config.yaml:/app/config.yaml
+    command: ["--config", "/app/config.yaml", "--port", "4000", "--host", "0.0.0.0"]
+    healthcheck:
+      test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://127.0.0.1:4000/health/readiness', timeout=3)\""]
+      interval: 5s
+      timeout: 3s
+      retries: 30
+    restart: unless-stopped
+
+  # --- PATCHED PROXY (Port 4001) ---
+  litellm-patched:
+    image: ghcr.io/berriai/litellm:v1.84.0
+    container_name: litellm-proxy-patched
+    depends_on:
+      db:
+        condition: service_healthy
+    environment:
+      DATABASE_URL: postgresql://litellm:litellm@db:5432/litellm
+      STORE_MODEL_IN_DB: "True"
+      LITELLM_MASTER_KEY: sk-local-master-vuln
+    ports:
+      - "4001:4000"
+    volumes:
+      - ./config.yaml:/app/config.yaml
+    command: ["--config", "/app/config.yaml", "--port", "4000", "--host", "0.0.0.0"]
+    healthcheck:
+      test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://127.0.0.1:4000/health/readiness', timeout=3)\""]
+      interval: 5s
+      timeout: 3s
+      retries: 30
+    restart: unless-stopped
+
+volumes:
+  postgres_data: