LiteLLM published an attack-chain report on 23 October 2026 saying stolen credentials enabled attackers to build, sign and publish compromised litellm==1.107.0 packages and container images on 21 October. Its account describes a release pipeline carrying out authorized-looking actions with stolen identities.[1]
According to LiteLLM, an administrative key committed to a public repository on 27 May remained valid after the file was deleted. On 10 October, the attacker used it to query the internal LiteLLM Agent Platform and retrieve an organization owner’s GitHub CLI OAuth token from managed-agent configuration. Malicious continuous integration (CI) workflows then extracted two maintainers’ tokens.[1]
The attacker changed the release workflow to accept a different source owner, overriding branch protection with the owner’s credentials. It then built from the lookalike Berri-AI/litellm fork. A stolen maintainer token approved the production gate; the pipeline signed and published the artifacts. Another token deleted release-run records, and forced history changes concealed the workflow modification from the main branch’s visible history, LiteLLM says.[1]
The report records PyPI quarantine by 13:23 UTC on 21 October and subsequent container-tag removal or repointing. It directs readers to a separate incident post for exposure checks and cleanup. This saved report names no fixed replacement version; its statement about issuing another release is a plan, not confirmation of delivery.[1]
[1]: LiteLLM, “The attack chain behind the v1.107.0 LiteLLM release,” 23 October 2026. https://litellm.vercel.app/blog/security-incident-oct-21-2026-attack-chain
Sources
Check or correct this page
Verification record
The digest below shows whether the text you are reading matches the published source. It does not show that the reporting is correct. The build computes it from this page's Markdown source and lists it in the site manifest.
f1ac81936da609c918336b39c79edfd8d0a4a520351541178f815545130078ca
