# Exposed LiteLLM Master Key Leads to Security Breach and Compromised GitHub Repositories

*Published October 26, 2026*
*Source: [https://thehackernews.com/2026/10/leaked-litellm-master-key-let-attackers.html](https://thehackernews.com/2026/10/leaked-litellm-master-key-let-attackers.html)*

## Executive Summary

*This is a Premium edition. The Executive Summary is available to sec-news.ai members —*
*[read it here](https://www.sec-news.ai/news/exposed-litellm-master-key-leads-to-security-breach-and-compromised-github-repositories) or [see plans](https://www.sec-news.ai/pricing).*

## Article

LiteLLM recently disclosed a significant security breach where an Agent Platform master key was inadvertently made public through a GitHub repository. This exposure happened in late May 2026, when a configuration file containing the master key was mistakenly published. The error was soon identified and addressed, but crucially, the master key was not revoked. This oversight allowed an attacker to exploit the key on October 10, 2026, gaining access to the LiteLLM Agent Platform. Once inside, the attacker extracted a GitHub CLI OAuth token, which was insufficiently restricted and linked to the GitHub organization owner's account. With this token, the attacker obtained owner-level access to all repositories, enabling further credential exfiltration.

The attacker capitalized on a temporary relaxation of LiteLLM's release approval process, which permitted any two engineers to initiate and approve releases. This change, intended to expedite updates, was leveraged by the attacker to trigger a release from a malicious repository. LiteLLM's investigation has clarified that the GitHub CLI OAuth tokens were not taken from internal logs, as initially believed. Instead, the attacker used the token to perform actions including credential harvesting and the deployment of malicious workflows.

Security firm Socket detailed the malicious activities, noting that the attacker introduced workflows designed to capture GitHub tokens and API keys. These targeted various systems, including LiteLLM deployment and services like OpenAI and AWS Bedrock. The attacker strategically committed these workflows to short-lived branches, minimizing traces in the repository's history.

The compromised LiteLLM version 1.107.0 features a malware module capable of executing on Python startup, even if LiteLLM is not imported, posing a threat to affected environments. This malware collects extensive data such as system information, SSH files, and credentials for various developer tools and platforms, sending the data to a remote server. The breach highlights the importance of stringent key management practices and the need for comprehensive security checks in software release pipelines.