{"schema_version":"0.9.0","id":"LR-2026-0262","record_version":2,"title":"LiteLLM master key exposure leads to GitHub org-owner token theft and poisoned release artifacts","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":44.1,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":3.84,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-28","extraction_run_id":null},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-28","incident_class":"security_compromise","failure_class":null,"agent_involved":false,"secondary_failure_classes":[],"trigger":"credential_exposure","duration":null,"detection_method":"unknown","summary":"Attackers used a master key exposed in a public repository to retrieve an unscoped GitHub organization-owner token from LiteLLM's internal agent platform, then stole two maintainer tokens, subverted the release workflow and published credential-stealing artifacts.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"major, because a live production compromise: Attackers subverted the release workflow and published credential-stealing artifacts, a live production compromise of the release pipeline.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":["credentials"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.bleepingcomputer.com/news/security/even-after-php2shell-blast-radius-matters-more-than-a-cvss-score/","publisher":"BleepingComputer","date":"2026-10-28","type":"press","title":"Even after PHP2Shell, blast radius matters more than a CVSS score","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.developer":"D","system.autonomy_level":"D","system.deployment_context":"D","event.adversarial_actor":"C","event.agent_involved":"D","event.incident_class":"D","event.trigger":"C","event.summary":"D","event.date_disclosed":"A","event.detection_method":"D","impact.data_categories_exposed":"C","impact.severity":"D","context.denominator_available":"D","context.country":"D","impact.severity_because":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"At LiteLLM, attackers used a master key exposed in a public repository to retrieve an unscoped GitHub organization-owner token from an internal agent platform."}],"event.trigger":[{"source_index":0,"quote":"At LiteLLM, attackers used a master key exposed in a public repository to retrieve an unscoped GitHub organization-owner token from an internal agent platform."}],"event.adversarial_actor":[{"source_index":0,"quote":"At LiteLLM, attackers used a master key exposed in a public repository to retrieve an unscoped GitHub organization-owner token from an internal agent platform."}],"event.agent_involved":[{"source_index":0,"quote":"At LiteLLM, attackers used a master key exposed in a public repository to retrieve an unscoped GitHub organization-owner token from an internal agent platform."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"That identity let them steal two more maintainer tokens, subvert the release workflow, and publish credential-stealing artifacts."}],"event.summary":[{"source_index":0,"quote":"At LiteLLM, attackers used a master key exposed in a public repository to retrieve an unscoped GitHub organization-owner token from an internal agent platform."}],"impact.severity":[{"source_index":0,"quote":"That identity let them steal two more maintainer tokens, subvert the release workflow, and publish credential-stealing artifacts."}],"impact.severity_because":[{"source_index":0,"quote":"That identity let them steal two more maintainer tokens, subvert the release workflow, and publish credential-stealing artifacts."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-28"}]},"notes_on_gaps":"Single press source; no primary disclosure, court filing or regulator document. Not stated: who first noticed the compromise (detection_method left unwritten), any containment, notification or remediation, dates of occurrence or disclosure, loss figures, affected counts, the operator's industry, size, country, and the model or harness behind the internal agent platform. event.agent_involved=false is classified from the source describing only attacker use of credentials, not autonomous agent behaviour; failure_class left null on that basis. event.root_cause left unwritten: the source names an exposed master key but not which control failed. No severity dollar band applies because no loss figure is stated; major rests on the live release-workflow compromise. system.tier: not set; no operator named and deployment_context is not a lab's. [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-28] system.developer: no source names the developer. system.autonomy_level: no source states the arrangement. system.deployment_context: no source states where it ran. event.agent_involved: classified from described behaviour. event.incident_class: a source states an attacker, an injected instruction or a misused credential caused the system to act, or that the system's own boundary (sandbox, permissions, weights, accounts) was breached. event.summary: classified from described behaviour. event.detection_method: no source says who first noticed. context.denominator_available: no denominator is available for this incident. context.country: no source states the operator's location."},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"LiteLLM's internal agent platform held an unscoped GitHub organization-owner token. A master key for that platform was exposed in a public repository.","quote":"At LiteLLM, attackers used a master key exposed in a public repository to retrieve an unscoped GitHub organization-owner token from an internal agent platform.","source_index":0,"grade":"D"},{"step":"went_wrong","text":"Attackers used the exposed master key to pull the org-owner token, breaching the platform's credential boundary. That identity then let them steal maintainer tokens and subvert the release workflow.","quote":"That identity let them steal two more maintainer tokens, subvert the release workflow, and publish credential-stealing artifacts.","source_index":0,"grade":"D"},{"step":"reached","text":"The action reached GitHub: an organization-owner token, two maintainer tokens and the release workflow. Credential-stealing artifacts were published from it.","quote":"That identity let them steal two more maintainer tokens, subvert the release workflow, and publish credential-stealing artifacts.","source_index":0,"grade":"D"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-28","source_urls":["https://www.bleepingcomputer.com/news/security/even-after-php2shell-blast-radius-matters-more-than-a-cvss-score/"]}}