LiteLLM poisoned PyPI and Docker release traced to a leaked, never-revoked admin key
LiteLLM said on October 21, 2026 that a malicious litellm 1.107.0 with a credential stealer and backdoor was published to PyPI, Docker Hub and GHCR. Its October 23 root cause report says an Agent Platform admin key committed to a public repository on May 27 was deleted but never revoked; on October 10 the attacker used it to retrieve a GitHub organization owner's CLI OAuth token, used workflows to steal two maintainers' tokens, and then pushed and approved the release.
- Victim
- LiteLLM (BerriAI) and users who installed litellm 1.107.0
- Industry
- Technology
- Country
- United States
- Intrusion began
- Oct 10, 2026
- First disclosed
- Oct 21, 2026
- Actor
- Unattributed
- Initial access
- Exposed secrets
- Identity control that failed
- Non-human identity
- MFA
- Not applicable (no interactive login)
- Abused identity
- Non-human (service account, token, key or app)
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
Deleting a leaked key from a repo is not revocation. Revoking on exposure, refusing to store other users' OAuth tokens in an agent platform, and requiring a human with phishing-resistant MFA for release approval would each have broken the chain.
Go deeper on SWI
Sources
- Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised, LiteLLM, Oct 21, 2026
- The attack chain behind the v1.107.0 LiteLLM release, LiteLLM, Oct 23, 2026
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Microsoft AI research SAS token exposed 38 TB of internal data 2023 · Exposed secrets
- Codecov Bash Uploader compromise via credential extracted from Docker image 2021 · Exposed secrets
- Zeabur shared cluster breached with a non-expiring admin token and plaintext AWS keys 2026 · Exposed secrets
- JadePuffer wipes Azure resources with compromised service principals 2026 · Exposed secrets
Cite this record
SWI Community Team. (2026). LiteLLM poisoned PyPI and Docker release traced to a leaked, never-revoked admin key. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2026-litellm-leaked-admin-key-poisoned-release/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.