CVE-2026-108596 Details
Description
OpenLIT 2.1.0 contains an authorization bypass vulnerability that allows authenticated users to read other projects' telemetry by supplying a forged x-openlit-project-id header. Attackers who know a victim project id and database config id can query the trace read API to obtain traces including LLM prompts and completions.
A vulnerability allowing authorization bypass has been identified in OpenLIT version 2.1.0. This issue enables authenticated users to access telemetry data from other projects by manipulating the 'x-openlit-project-id' header. Attackers aware of a target project's ID and its corresponding database configuration ID can exploit this vulnerability through the trace read API, retrieving sensitive information such as LLM prompts and completions.
The vulnerability can be addressed by modifying the 'getCurrentProjectId' function to validate the 'x-openlit-project-id' header against the user's actual project memberships, rather than accepting it at face value. Additionally, the 'withDbConfigAccess' route guard should be updated to compare the header-selected project with the caller's memberships before allowing access.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 10, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenLIT | >= 2.1.0, <= 2.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 10, 2026 | New CVE Received | [email protected] |