Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.7
CVE-2026-114612: LiteLLM proxy can let internal users become admin
CVE-2026-114612 · published 22 days ago
Summary
Versions of LiteLLM that act as an AI gateway reuse encryption data, which lets a logged‑in internal user create a fake admin token and gain full administrative control. This can lead to unauthorized changes and execution of commands on the server. Upgrade to the patched LiteLLM releases or apply the vendor's recommended update to stop the risk.
What to do
- Update litellm to version 1.100.4.
- Update litellm to version 1.101.3.
- Update litellm to version 1.102.2.
- Update litellm to version 1.103.1.
- Update litellm to version 1.104.0rc2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | – | litellm |
>= 1.91.0, < 1.100.4 >= 1.101.0, < 1.101.3 >= 1.102.0, < 1.102.2 >= 1.103.0, < 1.103.1 >= 1.104.0rc1, < 1.104.0rc2 Fix: upgrade to 1.100.4
|
| – | berriai | litellm | >= 1.87.0, < 1.100.4 |
Original advisory text
LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow. Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require EXPERIMENTAL_UI_LOGIN to be enabled, while versions after 1.91.0 are exploitable in the default configuration. This issue was fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-1146... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-114612 Vendor Advisory
- https://github.com/BerriAI/litellm/commit/1d5fdc87fed66b49e1df8cf7d708ad93249eb7... Patch
- https://github.com/BerriAI/litellm/releases/tag/v1.100.4 URL
- https://github.com/BerriAI/litellm/security/advisories/GHSA-7hp6-4w63-5g45 Vendor Advisory
- https://github.com/BerriAI/litellm/commit/f7cd90f09e9716652b38daec9f0640cdf49d58... Patch
- https://github.com/BerriAI/litellm Product
- https://github.com/advisories/GHSA-7hp6-4w63-5g45
- https://github.com/BerriAI/litellm/releases/tag/v1.101.3 URL
- https://github.com/BerriAI/litellm/commit/9fa1a641119dd0d4fe43e93622eae5f482ceb6... Patch
- https://github.com/BerriAI/litellm/releases/tag/v1.102.2 URL
- https://github.com/BerriAI/litellm/releases/tag/v1.103.1 URL
- https://github.com/BerriAI/litellm/releases/tag/v1.104.0-rc.2 URL
- https://github.com/BerriAI/litellm/commit/9161d7f9d6073603ba61ee4aa5e2c0ef5b37a8... Patch
- https://github.com/BerriAI/litellm/commit/a80eacacee118fbed54e3d98f239d17a63fac8... Patch
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
7.7
High
Type
CWE-269Improper Privilege Management
CWE-345Insufficient Verification of Data Authenticity
CWE-441Unintended Proxy or Intermediary ('Confused Deputy')
Timeline
Published22 Oct 2026
Updated13 Nov 2026
First seen22 Oct 2026
Sources
CVE-2026-114612 · NVD
CVE-2026-114612 · OSV
GHSA-7hp6-4w63-5g45 · GHSA
GHSA-7hp6-4w63-5g45 · OSV
CVE-2026-114612 · MITRE
Track software like this
Free during beta