BerriAI litellm up to 1.100.x Semantic Cache Layer access control

Summaryinfo

A vulnerability was found in BerriAI litellm up to 1.100.x. It has been classified as critical. Affected by this issue is the function _get_semantic_cache_tenant_scope/_get_metadata_variable_name of the component Semantic Cache Layer. The manipulation leads to access control. This vulnerability is referenced as CVE-2026-89032. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in BerriAI litellm up to 1.100.x. It has been rated as critical. This issue affects the function _get_semantic_cache_tenant_scope/_get_metadata_variable_name of the component Semantic Cache Layer. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other tenants' cached responses by exploiting a metadata key mismatch between _get_semantic_cache_tenant_scope() and _get_metadata_variable_name(). Attackers holding a valid virtual key can submit semantically similar prompts on affected routes such as /v1/responses and /bedrock/* to retrieve cached responses containing other tenants' personally identifiable information, financial data, or source code, and can cause agentic front-ends to auto-execute attacker-supplied tool calls under victim credentials by returning cached function_call or tool_calls payloads to a different principal.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-89032 since 09/10/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading to version 1.101.0-rc.1 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• BerriAI

Name

• litellm

Version

• 1.100

Website

• Product: https://github.com/BerriAI/litellm/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion