Skip to content
Heist/ feed
Critical

LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key

Type: advisorySource: Official CVE List1 source record

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow. Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require EXPERIMENTAL_UI_LOGIN to be enabled, while versions after 1.91.0 are exploitable in the default configuration. This issue was fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2.

Announced Source revision 1
Original source ↗

CVE-2026-114612

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-114612

litellm

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "BerriAI",
    "product": "litellm",
    "versions": [
      {
        "status": "affected",
        "version": ">= 1.87.0, < 1.100.4"
      },
      {
        "status": "affected",
        "version": ">= 1.101.0, < 1.101.3"
      },
      {
        "status": "affected",
        "version": ">= 1.102.0, < 1.102.2"
      },
      {
        "status": "affected",
        "version": ">= 1.103.0, < 1.103.1"
      },
      {
        "status": "affected",
        "version": ">= 1.104.0-rc.1, < 1.104.0-rc.2"
      }
    ]
  }
]
Related CVEs
CVE-2026-114612

Source reference: /cveMetadata/cveId

Publisher severity

critical

Source reference: /containers/cna/metrics

Event
#52249 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement