v1.96.0 is affected by two advisories published since it was pinned:
- CVE-2026-84377 / GHSA-3cv6-jpf6-8222: authenticated SSRF and
provider-credential exfiltration via unvalidated request-body URLs
(fixed 1.96.2 on that line). This container holds a billed provider key.
- CVE-2026-114612 / GHSA-7hp6-4w63-5g45: privilege escalation to proxy
admin via cross-domain reuse of the salt key (fixed 1.103.1; no 1.96.x
backport).
v1.106.6 (2026-10-28) is the newest stable release with no OSV advisories.
Tag and digest updated together; the index digest was read with
`docker buildx imagetools inspect` and cosign-verified against LiteLLM's
pinned public key. GATEWAY_REGISTRY_IMAGE in gateway.rs is kept in
lockstep.
Smoke-tested with a config shaped like render_config()'s output: the
proxy starts, /v1/messages without a key is a 401, and with the master
key the Anthropic-format request is translated and routed to the
configured OpenAI base. Note this LiteLLM refuses to start with no
master_key at all; Triple-C always renders one, so that is not a
regression for us.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
shadowdaoandClaude Opus 5.5
b0cea1240a