CVE-2026-114612 in LiteLLM
Summary
by MITRE • 10/22/2026
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow. Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require EXPERIMENTAL_UI_LOGIN to be enabled, while versions after 1.91.0 are exploitable in the default configuration. This issue was fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/22/2026
LiteLLM functions as a proxy server or AI gateway designed to standardize calls to various Large Language Model APIs into an OpenAI-compatible format. A critical security vulnerability was identified in specific versions of this software, ranging from 1.87.0 through 1.90.x and extending to 1.100.4, 1.101.3, 1.102.2, 1.103.1, and the release candidate 1.104.0-rc.2. The core technical flaw resides in the cryptographic implementation used for managing at-rest secrets and session tokens. Specifically, the proxy incorrectly reuses a single cryptographic context across different operations involving sensitive data. This design error violates fundamental principles of secure cryptography, particularly the requirement to maintain distinct encryption contexts or keys for different security domains to prevent cross-context attacks.
The exploitation of this vulnerability allows an authenticated internal user with access to metadata fields to perform a sophisticated credential forgery attack. By crafting specific metadata containing forged administrator credentials, the attacker can trigger the API-key flow within LiteLLM. Due to the reused cryptographic context, the system encrypts and returns these forged credentials as if they were legitimate administrative tokens. This process effectively bypasses authentication controls because the proxy server cannot distinguish between a legitimately issued token and one that has been maliciously constructed using the shared encryption state. The attacker then replays this ciphertext as a bearer token in subsequent requests.
Upon receiving the replayed ciphertext, the LiteLLM proxy erroneously trusts it as a valid administrator identity. This trust leads to a complete compromise of administrative privileges within the system. Once authenticated as an administrator, the attacker gains unrestricted access to sensitive configurations and operational controls. Most critically, this elevated privilege level permits the execution of arbitrary commands through the Model Context Protocol (MCP) standard input/output endpoint. The MCP stdio interface provides direct interaction with external tools and processes, meaning that successful exploitation results in remote code execution capabilities equivalent to full system control over the gateway infrastructure.
The operational impact is severe, as it allows an internal user to escalate privileges from a standard account to an administrative role without requiring additional authentication factors or exploiting separate vulnerabilities. For versions 1.87.0 through 1.90.x, exploitation requires that the EXPERIMENTAL_UI_LOGIN feature be explicitly enabled by the administrator. However, for all subsequent versions starting after 1.91.0 up to the patched releases, the vulnerability is exploitable in default configurations without any special features needing activation. This significantly broadens the attack surface and increases the risk of compromise across a wider range of deployments that may not have implemented additional security hardening measures.
This vulnerability aligns with CWE-327, which describes the use of a broken or risky cryptographic algorithm, specifically highlighting issues related to improper key management and context reuse. From an offensive perspective, this attack vector corresponds to MITRE ATT&CK techniques involving credential manipulation and privilege escalation via API abuse. The ability to forge administrative tokens through replay attacks also touches upon CWE-294 regarding authentication bypass by capture-replay of credentials.
To mitigate this risk, organizations running affected versions must upgrade immediately to LiteLLM version 1.100.4 or later, which includes the necessary cryptographic fixes. Until upgrading is possible, administrators should ensure that no internal users have access to metadata fields that could be manipulated for such attacks and consider restricting API-key flow permissions where feasible. Monitoring logs for unusual patterns of token generation and replay can also help in detecting potential exploitation attempts before full compromise occurs.