CERT24Leaked LiteLLM Master Key Enabled GitHub Token Theft and Release Pipeline HijackingLoading data…
CERT24Threat Observatory
Period

Leaked LiteLLM Master Key Enabled GitHub Token Theft and Release Pipeline Hijacking

LiteLLM said that an Agent Platform master key exposed in a public GitHub repository in May 2026 was not revoked. An unknown attacker used the key on October 10 to obtain a GitHub OAuth token associated with the GitHub organization owner's account and gain access to repositories and additional credentials. The attacker then altered the release pipeline and published a malicious LiteLLM version 1.107.0 to PyPI, Docker Hub, and GHCR.

← Back to intelligence

Leaked LiteLLM Master Key Enabled GitHub Token Theft and Release Pipeline Hijacking

LiteLLM said that an Agent Platform master key exposed in a public GitHub repository in May 2026 was not revoked. An unknown attacker used the key on October 10 to obtain a GitHub OAuth token associated with the GitHub organization owner's account and gain access to repositories and additional credentials. The attacker then altered the release pipeline and published a malicious LiteLLM version 1.107.0 to PyPI, Docker Hub, and GHCR.