Authorization Bypass Vulnerability in OpenLIT 2.1.0 by OpenLIT
CVE-2026-108596

6MEDIUM

Key Information:

Vendor

Openlit

Status
Openlit
Vendor
CVE Published:
10 October 2026

What is CVE-2026-108596?

OpenLIT 2.1.0 exhibits an authorization bypass vulnerability that enables authenticated users to gain unauthorized access to telemetry data from other projects. By crafting a forged x-openlit-project-id header, attackers can exploit this vulnerability, allowing them to read sensitive traces, including prompts and completions created by LLM. This can lead to significant data exposure if attackers are aware of specific project IDs and database configurations.

Affected Version(s)

openlit 2.1.0

References

https://hackmd.io/@haind/openlit-project-context-read
third-party-advisory
https://github.com/openlit/openlit/blob/9938c66638666ca5d...
technical-description
https://github.com/openlit/openlit/blob/9938c66638666ca5d...
technical-description

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.