TL;DR

what: An unrevoked LiteLLM Agent Platform master key leaked on GitHub in May 2026 let an attacker steal an org owner's GitHub token and publish a malicious LiteLLM 1.107.0 on October 21, 2026.

impact: The attacker held owner-level access to every BerriAI repository, harvested maintainer tokens plus API keys for Anthropic, OpenAI, AWS Bedrock, Together AI and more, and pushed poisoned builds to PyPI, Docker Hub and GHCR.

fix: PyPI quarantined 1.107.0, Docker Hub tags v1.107.0, latest, main-latest and main-stable were removed or repointed to verified clean images, and LiteLLM is revoking every token across its internal systems and vendor platforms.

who: Any organization that installed LiteLLM 1.107.0 or pulled the affected LiteLLM container tags on October 21, 2026, plus anyone whose inference keys pass through a LiteLLM gateway.

One secret that was flagged for revocation and never revoked gave an attacker owner-level control of the LiteLLM GitHub organization and a path to publish a malicious…