CVE-2025-0330 HIGH

CVE-2025-0330: Exposure of Sensitive Information in berriai/litellm

Vendor Berriai

Product berriai/litellm

Weakness CWE-1230

Published March 20, 2025

Last update March 20, 2025

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error occurs while parsing team settings. This vulnerability exposes sensitive information, including langfuse_secret and langfuse_public_key, which can provide full access to the Langfuse project storing all requests.

Key dates

02Disclosure timeline

March 20, 2025 CVE published

March 20, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-0330 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1230.html

Related vulnerabilities

04Related CVE

CVE-2025-47324 Exposure of Sensitive Information Through Metadata in Powerline Communication Firmware CVE-2026-45544 Nextcloud: Information Disclosure of view filter metdata via Broken Sensitive Data Masking in ViewService CVE-2025-26527 Non-searchable tags can still be discovered on the tag search page and in the tags block CVE-2024-10324 RomethemeKit For Elementor <= 1.5.2 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates CVE-2024-9447 Exposure of Sensitive Information in transformeroptimus/superagi