LiteLLM 公布入侵事件细节：泄露密钥未吊销，最终导致发布版本被植入后门
AI 导读
LiteLLM 公布了 v1.107.0 发布版本被植入后门所涉攻击链的调查，研究者 Johann Rehberger 摘述了其中几个关键节点。用于给 LiteLLM 植入后门的密钥在 2026 年 5 月 27 日意外泄露，机构内部发现了这次泄露，但密钥始终没有被吊销，作者称攻击者似乎也拿到了它。10 月 10 日，攻击者利用该密钥进一步取得 GitHub 凭证访问权限，最终侵入 LiteLLM 的发布流程并植入后门。从密钥泄露到被利用相隔 4 个多月。
推荐理由
从密钥泄露到发布版本被植入后门相隔四个多月，依赖 LiteLLM 的团队可据此回看凭证管理和发布链路的薄弱环节。
正文 · 原文
Recent LiteLLM compromise details
- Key used to backdoor LiteLLM was accidentally leaked on May 27, 2026
- the leak was discovered internally, but key was never revoked! Seems attacker got hold of it too
- On October 10, the attacker exploited it, gained further access to GitHub creds, and ultimately backdoored LiteLLM releases
More than 4 months between exposure and exploitation
We have completed our investigation into the attack chain behind the v1.107.0 release. Read it here: https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain在 X 查看被引用的帖子