{"id":"CVE-2026-114612","published":"2026-10-22T19:17:37.540","lastModified":"2026-10-23T19:42:24.553","description":"LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow. Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require EXPERIMENTAL_UI_LOGIN to be enabled, while versions after 1.91.0 are exploitable in the default configuration. This issue was fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-269","CWE-345","CWE-441"],"vendors":[],"products":[],"references":[{"url":"https://github.com/BerriAI/litellm/commit/1d5fdc87fed66b49e1df8cf7d708ad93249eb7d0","tags":[]},{"url":"https://github.com/BerriAI/litellm/commit/9161d7f9d6073603ba61ee4aa5e2c0ef5b37a81b","tags":[]},{"url":"https://github.com/BerriAI/litellm/commit/9fa1a641119dd0d4fe43e93622eae5f482ceb63f","tags":[]},{"url":"https://github.com/BerriAI/litellm/commit/a80eacacee118fbed54e3d98f239d17a63fac818","tags":[]},{"url":"https://github.com/BerriAI/litellm/commit/f7cd90f09e9716652b38daec9f0640cdf49d582b","tags":[]},{"url":"https://github.com/BerriAI/litellm/releases/tag/v1.100.4","tags":[]},{"url":"https://github.com/BerriAI/litellm/releases/tag/v1.101.3","tags":[]},{"url":"https://github.com/BerriAI/litellm/releases/tag/v1.102.2","tags":[]},{"url":"https://github.com/BerriAI/litellm/releases/tag/v1.103.1","tags":[]},{"url":"https://github.com/BerriAI/litellm/releases/tag/v1.104.0-rc.2","tags":[]},{"url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-7hp6-4w63-5g45","tags":[]}],"exploitRefs":[{"url":"https://github.com/BerriAI/litellm/commit/1d5fdc87fed66b49e1df8cf7d708ad93249eb7d0","tags":[]},{"url":"https://github.com/BerriAI/litellm/commit/9161d7f9d6073603ba61ee4aa5e2c0ef5b37a81b","tags":[]},{"url":"https://github.com/BerriAI/litellm/commit/9fa1a641119dd0d4fe43e93622eae5f482ceb63f","tags":[]},{"url":"https://github.com/BerriAI/litellm/commit/a80eacacee118fbed54e3d98f239d17a63fac818","tags":[]},{"url":"https://github.com/BerriAI/litellm/commit/f7cd90f09e9716652b38daec9f0640cdf49d582b","tags":[]},{"url":"https://github.com/BerriAI/litellm/releases/tag/v1.100.4","tags":[]},{"url":"https://github.com/BerriAI/litellm/releases/tag/v1.101.3","tags":[]},{"url":"https://github.com/BerriAI/litellm/releases/tag/v1.102.2","tags":[]},{"url":"https://github.com/BerriAI/litellm/releases/tag/v1.103.1","tags":[]},{"url":"https://github.com/BerriAI/litellm/releases/tag/v1.104.0-rc.2","tags":[]},{"url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-7hp6-4w63-5g45","tags":[]}],"hasPoc":true,"ai":{"summary":"The LiteLLM proxy server reused a single cryptographic context for secrets and session tokens, enabling authenticated internal users to forge administrator credentials by crafting malicious metadata that, when replayed as a bearer token, granted full administrative access via the MCP stdio endpoint.","exploitability":"An authenticated internal user with low privileges can exploit this flaw without user interaction or complex conditions, requiring only knowledge of the vulnerable API flows.","blast_radius":"Successful exploitation grants full administrative control over the proxy, enabling arbitrary command execution through the MCP stdio endpoint, potentially compromising all downstream LLM API calls and sensitive data processed by the system.","remediation":"Upgrade to LiteLLM version 1.100.4, 1.101.3, 1.102.2, 1.103.1, or 1.104.0-rc.2 (or later) immediately.","detection":"Look for API-key authentication requests returning encrypted metadata containing unexpected or malformed credential structures, and monitor for bearer tokens that decode to administrative privileges without corresponding high-privilege login events; no reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","credential-forge","rce","mcp","proxy","crypto-misuse"],"model":"garnet-coder","analyzedAt":"2026-10-24T08:50:41.505Z"}}