CVE-2026-108596

MEDIUM 5.3

OpenLIT 2.1.0 Authorization Bypass via x-openlit-project-id Header

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

OpenLIT 2.1.0 contains an authorization bypass vulnerability that allows authenticated users to read other projects' telemetry by supplying a forged x-openlit-project-id header. Attackers who know a victim project id and database config id can query the trace read API to obtain traces including LLM prompts and completions.

CWE	CWE-639
Vendor	openlit
Product	openlit
Published	Oct 10, 2026

Stay Ahead of the Next One

Get instant alerts for openlit openlit

Be the first to know when new medium vulnerabilities affecting openlit openlit are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

openlit / openlit

2.1.0 ≤ 2.1.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@haind/openlit-project-context-read github.com: https://github.com/openlit/openlit/blob/9938c66638666ca5d3bcb850350faa82e510924b/src/client/src/lib/telemetry-source.ts#L113-L125 github.com: https://github.com/openlit/openlit/blob/9938c66638666ca5d3bcb850350faa82e510924b/src/client/src/middleware/check-auth.ts#L22-L33 github.com: https://github.com/openlit/openlit vulncheck.com: https://www.vulncheck.com/advisories/openlit-2.1.0-authorization-bypass-via-x-openlit-project-id-header

Credits

HaiND from the Post and Telecommunication Institute of Technology