litellm

Image · AI gateway · standard · v1.106.2

D 21cosign signedSPDX SBOMSLSA provenanceamd64 · arm64Rebuilt 2026-10-22

LiteLLM proxy, one OpenAI-compatible API to call, route, budget and log 100+ LLM providers. MIT build from PyPI in a Python 3.13 venv on a hardened nonroot Wolfi base, serving on 4000; the proprietary litellm-enterprise package is excluded and the build fails if it appears.

Version

1.106.2 · latest 1.103.7

The latest line lives at the base page; older lines have their own page so you can pin and verify exactly that version.

Current digest (deployed by the chart)

sha256:2388983ffcb2c64ff6a959b090bb058d6453ac73f4d8266b7544b6b821249ab6

Signatures, the SBOM, and provenance all attach to this digest. Pin to it for reproducible, tamper-evident pulls.

Image

ghcr.io/quenchworks/images/litellm:1.106.2

Signed

cosign keyless

SBOM

SPDX, on digest

Provenance

SLSA build

Architectures

amd64, arm64

Runs as

nonroot (uid 1001)

Root filesystem

read-only

Image size

181.3 MB

Published versions

2 tags

Each tag is a multi-arch index (amd64 + arm64) pinned by digest. Tagged by version, never :latest.

Version	Size	Published	Digest
1.106.2latest	181.3 MB	2026-10-22	sha256:717dc9fcc052…
1.103.7	171.2 MB	2026-10-22	sha256:2388983ffcb2…

Security report (Trivy)

D· 0/10021 fixable · rebuild clears them

Vulnerability detail

litellm 1.106.2 · 21 CVE

CVE	Severity	Package	Installed	Fixed in	Title
CVE-2026-111943	HIGH	py3-pip-wheel	26.2.2-r0	26.2.2-r2	crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates
CVE-2026-112940	HIGH	filelock	3.32.7	4.2.1	filelock: filelock: Arbitrary file overwrite via insecure database file reopening
CVE-2026-114613	HIGH	py3-pip-wheel	26.2.2-r0	26.2.2-r1	msgpack: msgpack: Denial of Service via memory leak during map deserialization
CVE-2026-112908	MEDIUM	filelock	3.32.7	4.2.1	filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold
CVE-2026-112909	MEDIUM	filelock	3.32.7	4.2.1	filelock: filelock: arbitrary file truncation via lock path replacement
CVE-2026-112910	MEDIUM	filelock	3.32.7	4.2.1	filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL
CVE-2026-112911	MEDIUM	filelock	3.32.7	4.2.1	filelock: filelock: Lock bypass via pre-created shared protocol directory
CVE-2026-112915	MEDIUM	filelock	3.32.7	4.2.1	filelock: filelock: Denial of Service via crafted SQLite lock database
CVE-2026-112935	MEDIUM	filelock	3.32.7	4.2.1	filelock: filelock: Unauthorized concurrent access via stale lock cleanup race condition
CVE-2026-112936	MEDIUM	filelock	3.32.7	4.0.9	filelock: filelock: Lock redirection and mutual exclusion bypass via symbolic links
CVE-2026-112938	MEDIUM	filelock	3.32.7	4.2.1	filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses
CVE-2026-112939	MEDIUM	filelock	3.32.7	4.2.1	filelock: filelock: Unauthorized lock acquisition via forged process identifier in SoftFileLock
CVE-2026-114583	MEDIUM	python-3.13	3.13.16_git20261016-r1	3.13.18_git20261030-r0	tarfile.tar_filter could be bypassed using crafted link entries, inclu ...
CVE-2026-114583	MEDIUM	python-3.13-base	3.13.16_git20261016-r1	3.13.18_git20261030-r0	tarfile.tar_filter could be bypassed using crafted link entries, inclu ...
CVE-2026-115557	MEDIUM	python-3.13	3.13.16_git20261016-r1	3.13.18_git20261030-r0	Python has added a denylist for known compromised certificates to the ...
CVE-2026-115557	MEDIUM	python-3.13-base	3.13.16_git20261016-r1	3.13.18_git20261030-r0	Python has added a denylist for known compromised certificates to the ...
CVE-2026-12345	MEDIUM	python-3.13	3.13.16_git20261016-r1	3.13.18_git20261030-r0	python: python: Arbitrary file deletion via race condition during temporary directory cleanup
CVE-2026-12345	MEDIUM	python-3.13-base	3.13.16_git20261016-r1	3.13.18_git20261030-r0	python: python: Arbitrary file deletion via race condition during temporary directory cleanup
CVE-2026-112907	LOW	filelock	3.32.7	4.2.1	filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break
CVE-2026-112912	LOW	filelock	3.32.7	4.2.1	filelock: filelock: Information disclosure via symbolic link following in SoftFileLock
CVE-2026-112913	LOW	filelock	3.32.7	4.2.1	filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database

Critical

High

Medium

Low

Unknown

fixable per nightly scan · peak 32 of 115 days with any · 2026-06-29 to 2026-10-22

Pull the image

Run it directly with Docker, Podman, or any Kubernetes workload. Nonroot, read-only root filesystem, built for amd64 and arm64.

Pull (tag)

docker pull ghcr.io/quenchworks/images/litellm:1.106.2

Pinned by digest (recommended)

docker pull ghcr.io/quenchworks/images/litellm@sha256:2388983ffcb2c64ff6a959b090bb058d6453ac73f4d8266b7544b6b821249ab6

Tags

1.106.21.106.2-amd641.106.2-arm64

Images are tagged by app version (never :latest): a multi-arch index plus per-arch tags.

App version: 1.106.2
Architectures: amd64, arm64
Runs as: nonroot (uid 1001)
Root filesystem: read-only
License: MIT

Verify the supply chain

This image is cosign-signed and carries an SPDX SBOM and a SLSA build-provenance attestation on the same digest. Check all three yourself:

# 1. signature — built and signed by QuenchWorks CI
cosign verify ghcr.io/quenchworks/images/litellm:1.106.2 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. SLSA build provenance — which workflow built it, from what
cosign verify-attestation --type https://slsa.dev/provenance/v1 ghcr.io/quenchworks/images/litellm:1.106.2 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 3. SPDX SBOM — the package inventory
cosign verify-attestation --type https://spdx.dev/Document/v2.3 ghcr.io/quenchworks/images/litellm:1.106.2 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

See the SBOM & provenance guide for reading the SBOM and using these checks in CI.

Transparency

Every image carries its SBOM and provenance as attestations on the same digest, publicly verifiable with the commands above (they check the package and the Sigstore transparency log, Rekor).

View the Helm chart View package

Upstream project: https://www.litellm.ai