LiteLLM Master Key Leak Enables GitHub Token Theft and Release Pipeline Hijack

A master key for LiteLLM’s Agent Platform was committed to the public LiteLLM-Labs/lite-harness repository on May 27 2026. The key was later used by an attacker to extract a GitHub CLI OAuth token on Oct 10 2026. The token was not scoped and was linked to the organization owner’s account, giving the attacker owner-level access to every repository in the organization.

The attacker accessed the Agent Platform with the leaked key, then pulled the OAuth token that the platform used to authenticate self-hosted agents. With the token, the attacker performed a series of actions:

• Between 10:11 and 10:12 p.m. UTC on Oct 10, the attacker committed code to throwaway branches in internal repositories to run workflows that captured OAuth tokens for two engineers with maintainer privileges via a malicious webhook endpoint.
• On Oct 21, the attacker overrode branch protection rules and altered the release pipeline to point to a look-alike repository, "Berri-AI/litellm", instead of the legitimate "BerriAI/litellm".
• At 11:39 a.m. UTC on Oct 21, the attacker published LiteLLM version 1.107.0 to PyPI.
• At 11:46 a.m. UTC the same day, Docker Hub and GHCR images were pushed.
• Between 11:53 and 11:54 a.m. UTC, production and staging run records were deleted.

• The master key was not revoked after the accidental commit was discovered.
• The GitHub OAuth token had owner scope and was not restricted to a narrower set of permissions.
• Branch protection rules were overridden without audit or alerting.
• The release pipeline was redirected to a malicious repository without verification of the source.

• Commit history in the LiteLLM-Labs/lite-harness repository shows the key in the configuration file.
• GitHub audit logs record the OAuth token extraction and the subsequent workflow runs.
• PyPI and Docker registry timestamps confirm the publication of the malicious releases.
• GitHub branch protection changes are logged in the organization’s audit trail.

1. Revoke all exposed keys immediately and enforce automated revocation for any key that appears in public code.
2. Restrict OAuth tokens to the minimum scopes required for CI/CD operations; avoid owner-level tokens.
3. Enable branch protection enforcement and require signed commits for critical branches.
4. Monitor release pipeline configurations for unexpected changes and verify source repositories.
5. Audit workflow runs for anomalous activity, especially those triggered by external webhooks.
6. Implement key rotation and secret scanning in CI/CD pipelines to catch accidental commits.

The incident demonstrates that a single accidental exposure of a high-privilege key can cascade into full organization compromise. It underscores the necessity of automated key lifecycle management and strict token scoping in cloud and CI/CD environments.

• Conduct a full audit of all OAuth tokens and secret stores.
• Verify that all repositories have correct branch protection rules.
• Review and harden the release pipeline to prevent unauthorized redirects.
• Apply the latest security patches to LiteLLM and related tooling.
• Consider implementing a secrets management solution that integrates with GitHub’s secret scanning.

For additional guidance on securing GitHub workflows and managing secrets, see the Zero-Day Vulnerability & CVE Exploit Matrix.