Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesThe safest LiteLLM upgrade is the newest patch in one of LiteLLM’s four supported stable minor lines. The release index listed v1.105.0 on October 11, 2026, but check that index immediately before changing production because the supported target can move. Pin the exact package, container tag or digest; verify the artifact’s signature; rotate exposed credentials; run database migrations in a controlled job; and test readiness, models, a real completion, key access and the UI before declaring the gateway secure.
Do not treat one fixed release as a universal answer. The March 2026 PyPI supply-chain incident involved 1.82.7 and 1.82.8, v1.83.0 fixed CVE-2026-35029 and CVE-2026-35030, and v1.83.7 fixed CVE-2026-42208 for which LiteLLM recommends v1.83.10-stable. These are different risk windows, so your first task is to inventory every copy of LiteLLM and determine which advisories apply.
As an Amazon Associate I earn from qualifying purchases.
What counts as a secure LiteLLM patch
A deployment is not secure merely because its process starts or because a package manager reports the latest available version. A defensible patch has six properties:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- Every direct and indirect LiteLLM installation is identified, including copies inside internal platforms, CI images, Helm releases, vendor tools and rollback bundles.
- The selected version belongs to a currently supported minor line and is that line’s latest patch.
- The package or image is pinned to an immutable version reference and its provenance is verified before promotion.
- Database migrations run once, under an operator-controlled job, rather than racing across proxy replicas.
- Master and provider credentials are protected and rotated when exposure is possible.
- Authenticated tests prove the database, Redis cache, provider route, virtual keys and administrative surfaces still behave as intended.
LiteLLM’s support policy covers the four latest stable minor lines; older minor lines are end of life. “Latest” is therefore a moving policy decision, not a permanent version number. Record the release-index date, selected line and exact patch in your change ticket.
#1 Best Overall
Version and incident map
Use this map to interpret the main 2026 advisories. It is a decision aid, not permission to remain on an old line.
| Version or range | What the published guidance establishes | Required action |
|---|---|---|
| 1.82.7 and 1.82.8 from PyPI | These versions were involved in the March 2026 LiteLLM supply-chain incident. | Isolate affected hosts, preserve logs and artifacts, investigate exposure, rotate credentials as appropriate, and replace the artifacts with a clean, supported release. |
| 1.83.0 | LiteLLM published it as a clean release after the incident and identified it as fixing CVE-2026-35029 and CVE-2026-35030. | Do not stop here if a newer supported patch is available; use it as evidence when tracing the incident timeline. |
| 1.83.7 | It fixed CVE-2026-42208. | LiteLLM recommends 1.83.10-stable for that advisory; move to a newer supported minor line when possible. |
| 1.83.10-stable | It is the recommendation associated with the CVE-2026-42208 advisory. | Use only when your compatibility plan requires the 1.83 line; otherwise select the latest patch in a supported newer line. |
| 1.84.1 | LiteLLM’s May 2026 town hall said all security fixes from the preceding four weeks were bundled in this release. | Treat the statement as a historical release note, then verify later advisories before choosing it today. |
| 1.104.0 | The proxy refuses to start with an unset, empty or publicly known unsafe master key and fails authentication closed during database outages. | Use these defaults as a hardening baseline, while still applying current security patches. |
| 1.105.0 | The official release index listed it on October 11, 2026. | Check whether it remains the newest patch in a supported line immediately before deployment and pin the exact artifact. |
LiteLLM reported 89 vulnerabilities patched, including 78 reported by the Veria scanner, 58 fixed GHSAs and 96 closed GHSAs in its 2026 reporting. Those figures describe issue handling; they do not quantify how many deployments were affected.
1. Inventory every deployment before touching production
Make an inventory that can be audited later. Search source repositories, lockfiles, container build files, Kubernetes manifests, Helm values, CI cache layers and internal products that embed LiteLLM. A gateway may be exposed even when the package is not installed on the host you first inspect.
Free tools Windows power users keep installed
One-click scans. No signup required.
Record the artifact and its location
- For Python, record the exact version shown by the environment’s package metadata and the lockfile or constraints file that selected it.
- For containers, record the image repository, tag, digest, registry, build pipeline and every running workload that references it.
- For Helm, record chart version, image repository, image tag or digest, values files and release namespace.
- For CI and vendor tools, record cached wheels, base images and generated deployment bundles; note whether they can later be promoted into production.
- Record database, Redis and provider endpoints, the ingress exposure, administrative users, virtual-key scope and the location of secret-manager entries.
Freeze evidence for the incident versions
If any inventory item contains PyPI 1.82.7 or 1.82.8, do not immediately delete and recreate it. Preserve package files, container layers, process and network logs, shell history, deployment manifests and relevant host snapshots. LiteLLM’s incident guidance calls for host investigation and preservation of artifacts for forensics. Capture timestamps and hashes before cleanup, then restrict network access while the investigation proceeds.
Search indirect copies
Scan built images rather than relying only on the application repository. Inspect multi-stage Docker builds, private wheel caches, air-gapped mirrors, notebook images, scheduled jobs and disaster-recovery artifacts. A clean primary deployment does not prove that a stale CI image or standby cluster is safe.
2. Select a supported target and freeze the change
Open the official LiteLLM release index immediately before the change. Identify the four latest stable minor lines, discard end-of-life lines, and choose the newest patch in the line that your integrations support. Write down the chosen version, release date, migration notes, rollback artifact and the tests that will gate promotion.
Evaluate more than the CVE number
Compare candidate targets on supported-line status, coverage of the advisories relevant to your exposure, artifact provenance, deterministic rollback, migration behavior, authentication defaults, secret-rotation impact and post-upgrade test coverage. A release that fixes one CVE but leaves you on an end-of-life minor line is not an adequate long-term target.
Build a rollback pair
Keep the last verified production artifact and the new verified artifact available at the same time. For a container, retain the old digest; for Python, retain a locked wheel set or a reproducible package lock. Back up the database according to your normal recovery policy and document how to return traffic to the previous version without rerunning a destructive migration.
3. Upgrade the package, image or Helm release
Python or pip installation
Install an exact version in a disposable environment first, run your application test suite, and promote the same locked artifact to production. The command below deliberately uses an explicit version variable rather than a floating specifier:
export LITELLM_VERSION="1.105.0"
python -m pip install --upgrade "litellm==${LITELLM_VERSION}"
python -m pip show litellmReplace the variable with the supported patch selected from the release index. Verify the installed metadata and package hash against the artifact approved by your build process. Do not allow a resolver to silently downgrade LiteLLM because another dependency has an old upper bound; resolve that conflict before production.
Docker deployment
LiteLLM’s production guidance identifies ghcr.io/berriai/litellm for monolithic deployments and says to pin a version tag rather than latest or a moving tag so rollbacks are deterministic. Pull the exact tag selected in your change plan, record the resulting digest, and deploy that digest through every environment. A tag pin is better than latest; a digest pin prevents a registry tag from changing after approval.
docker pull ghcr.io/berriai/litellm:1.105.0
docker image inspect ghcr.io/berriai/litellm:1.105.0Use the image repository approved for your deployment model, and verify that the digest in the runtime manifest is the digest you inspected. Do not mix a newly pulled image with an unreviewed entrypoint, environment file or mounted configuration.
Helm or Kubernetes
Update the chart values to the exact image tag or digest, render the manifests, and review the resulting Deployment, migration job, secrets references, probes and ingress. Apply the migration as the documented migration job. When the deployment guide calls for it, set DISABLE_SCHEMA_UPDATE=true on proxy instances so replicas do not race the migration job. Wait for the migration job to complete successfully before allowing all proxy replicas to receive traffic.
Roll out one controlled canary where your availability design permits it. Confirm logs, readiness and authenticated traffic before increasing the replica count. Keep the previous verified image available until the full functional checklist passes.
4. Verify provenance and signatures before rollout
Use the official image registry and LiteLLM’s documented cosign procedure. The supply-chain guidance requires Docker image signature verification against a pinned public-key commit. Obtain the public-key commit and the exact cosign command from that guidance, run it against the immutable image reference, and require both a valid signature and a valid claim before promotion.
Rank #4
- Verify the registry and repository are the intended official locations.
- Verify the digest, not only the human-readable tag, matches the approved change record.
- Pin the public-key commit used by cosign; do not fetch an unpinned key at verification time.
- Save cosign output, image digest, verification time and operator identity with the release evidence.
- Fail the rollout if signature, claim, digest or key provenance cannot be established.
A successful package download or a container that starts is not provenance verification. Keep the prior verified artifact for rollback until health and behavior checks finish.
5. Rotate secrets and review permissions
Master key
Treat LITELLM_MASTER_KEY as root access. Store it in a secret manager, inject it at runtime, and avoid placing it in source control, image layers, shell history or publicly readable manifests. Rotate it if an affected gateway was reachable by an untrusted network, if logs or configuration may have exposed it, or if your incident review cannot rule out access. Update automation and clients in a coordinated window because an immediate rotation invalidates callers that still use the old key.
Salt key
Keep LITELLM_SALT_KEY stable after provider credentials have been stored. Changing it makes encrypted provider credentials unreadable. Protect it in the same secret-management system, limit access, and rotate it only through a planned re-encryption or credential-replacement procedure that you have tested on a copy of the database.
Provider keys and virtual keys
If an affected gateway was exposed, review provider API keys and rotate those whose use cannot be ruled out. Give applications scoped virtual keys instead of the master key, limit models and budgets to the smallest required set, and revoke unused keys. Confirm that an existing virtual key still works after the change without granting it administrative privileges.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →6. Apply configuration hardening
- Terminate traffic through HTTPS at the ingress and redirect or block plaintext access.
- Set trusted proxy ranges explicitly so client-IP and authorization decisions cannot be forged through arbitrary forwarding headers.
- Restrict the Admin UI to administrators through network policy and identity controls; do not expose it as a general user portal.
- Keep stdio MCP servers disabled unless a documented use case requires them, and review every enabled server’s command and filesystem permissions.
- Use the hardened startup behavior introduced in v1.104.0: the proxy refuses an unset, empty or publicly known unsafe master key, and authentication fails closed during database outages.
- Separate migration credentials from ordinary runtime credentials where your database policy permits it, and remove elevated credentials after the migration job.
Review the effective configuration inside the running container or pod. A secure values file is not enough if a later overlay, environment variable or sidecar changes the runtime behavior.
Best Value
7. Run authenticated post-upgrade checks
Readiness is necessary but insufficient. The following sequence checks the gateway, model registry, provider path, key service, UI route and existing virtual-key behavior. Set MODEL_NAME to a model that appears in your deployment’s model list and is permitted for the test key.
export LITELLM_MASTER_KEY="..."
export MODEL_NAME="model-id-from-your-model-list"
curl -sS https://llm.example.com/health/readiness
curl -sS https://llm.example.com/v1/models
-H "Authorization: Bearer $LITELLM_MASTER_KEY"
curl -sS https://llm.example.com/v1/chat/completions
-H "Authorization: Bearer $LITELLM_MASTER_KEY"
-H 'Content-Type: application/json'
-d '{"model":"'"$MODEL_NAME"'","messages":[{"role":"user","content":"security verification ping"}]}'
curl -sS https://llm.example.com/key/info
-H "Authorization: Bearer $LITELLM_MASTER_KEY"
curl -sSI https://llm.example.com/ui/Interpret each result
- Readiness: confirm the response reports the Redis cache and other dependencies as healthy. A green response does not prove that stored data or a provider can be used.
/v1/models: compare the model set with the prior deployment. Missing or unexpected models usually indicate configuration, database or permission drift.- Chat completion: require an authenticated, successful response from a representative provider route. This catches failures that readiness cannot see.
/key/info: verify the key’s identity, scope and limits without exposing secret material in logs.- UI head request: confirm the route is reachable only from the intended administrative network and that HTTPS and redirects behave as designed.
Repeat the completion and key checks with an existing application virtual key. Test an intentionally unauthorized operation as well; it should be denied, proving that the upgrade did not broaden scopes.
8. Investigate exposure from CVE-2026-42208
For gateways that operated in the affected range, review PostgreSQL query history with the helper query provided in LiteLLM’s advisory. Correlate database access with ingress logs, administrator changes, configuration edits, provider-key use, unexpected outbound requests and billing anomalies. Preserve the original evidence before rotating or deleting anything, then record the time range examined and the conclusion for each indicator.
Recommended Free Tools
Do not infer safety from the absence of a known exploit string. Look for unusual reads of key, user, model or configuration tables, new administrator accounts, changed proxy settings, unexplained provider traffic and spending spikes. If you cannot establish the exposure boundary, treat the master and provider credentials as compromised and follow your incident-response policy.
9. Troubleshoot common upgrade failures
| Symptom | Likely cause | Recovery |
|---|---|---|
| Proxy refuses to start because the master key is unsafe | The configured key is missing, empty or publicly known. | Generate a new high-entropy key, store it in the secret manager, update clients, and restart only after the new secret is present. |
| Authentication fails after rotation | Clients still send the old master or virtual key, or a secret reference points to the wrong version. | Check the runtime environment and secret-manager version, update clients deliberately, and revoke the old credential after confirming cutover. |
| Stored provider credentials cannot be decrypted | LITELLM_SALT_KEY changed after credentials were encrypted. |
Restore the original salt key or follow a tested re-encryption and provider-key replacement procedure; do not keep changing the salt while diagnosing. |
| Readiness is green but completions fail | Readiness covers service dependencies, not provider authorization, model routing or a valid virtual key. | Run an authenticated chat completion, inspect provider and routing logs, verify model permissions and check provider credentials. |
| Models differ from the previous deployment | Migration did not complete, a values overlay changed routing, or the new image reads a different database. | Compare rendered configuration, database endpoint, migration-job logs and /v1/models output before expanding traffic. |
| Replicas show migration conflicts | Multiple proxy instances attempted schema updates concurrently. | Run the documented migration job once and set DISABLE_SCHEMA_UPDATE=true on proxy instances when required by the deployment guide. |
| Signature verification fails | The image digest, registry, cosign key commit or signature does not match the approved release. | Stop promotion, re-pull from the official registry, verify the pinned key and investigate any mismatch as a supply-chain event. |
| Admin UI is reachable from an untrusted network | Ingress or trusted-proxy rules expose the administrative route broadly. | Restrict the route at the network and identity layers, then retest from an allowed and a denied source. |
10. Roll back without losing the evidence trail
- Stop promotion and preserve logs, image digests, package hashes, migration output and test responses.
- Decide whether the failure is application behavior, migration state, credential state or artifact provenance; do not roll back blindly after a schema change.
- Route traffic to the prior verified artifact using its recorded digest or locked wheel set.
- Keep the database backup and migration records. Never overwrite them with an untracked restore.
- If credentials were rotated, keep the new credentials active unless your incident lead determines that the rotation itself caused the outage; restoring an old exposed key can recreate the security problem.
- After service is stable, correct the failed configuration or dependency, repeat provenance and functional tests, and document the revised promotion decision.
11. Maintain the secure state
Schedule a recurring inventory of package versions, image digests, Helm values, CI caches and rollback artifacts. Subscribe to LiteLLM release and advisory updates, but still check the release index at every change. Rebuild images from approved inputs, remove stale vulnerable artifacts from registries and caches, and test that a revoked virtual key is rejected.
Keep a short evidence bundle for every upgrade: selected release and date, package or image digest, cosign output, migration-job result, secret-rotation decision, readiness response, model-list comparison, representative completion, key-information response, UI access result and rollback reference. This turns “the gateway is running” into a repeatable security verification that can be repeated after the next advisory.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
