{"id":"CVE-2026-114612","published":"2026-10-22T19:17:37Z","modified":"2026-10-30T19:18:11Z","title":"LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format","vendor":"BerriAI","product":"litellm","tier":"core","eol":null,"description":{"text":"LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow. Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require EXPERIMENTAL_UI_LOGIN to be enabled, while versions after 1.91.0 are exploitable in the default configuration. This issue was fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2.","provenance":"source","from":"NVD"},"summary":{"text":"LiteLLM's proxy server, an AI Gateway for calling LLM APIs, reuses a single cryptographic context for both at-rest secrets and session tokens, so an authenticated internal user can craft metadata that yields a forged administrator credential through the API-key flow. An attacker with low-privilege authenticated access and no user interaction can replay that forged credential as a bearer token to gain administrative access and run arbitrary commands via the MCP stdio endpoint, with versions 1.87.0 through 1.90.x additionally requiring EXPERIMENTAL_UI_LOGIN to be enabled.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:25:04Z"},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00319,"percentile":0.24907,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-269","name":"Improper Privilege Management"},{"id":"CWE-345","name":"Insufficient Verification of Data Authenticity"},{"id":"CWE-441","name":"Unintended Proxy or Intermediary"}],"references":[{"url":"https://github.com/BerriAI/litellm/commit/1d5fdc87fed66b49e1df8cf7d708ad93249eb7d0","tags":[]},{"url":"https://github.com/BerriAI/litellm/commit/9161d7f9d6073603ba61ee4aa5e2c0ef5b37a81b","tags":[]},{"url":"https://github.com/BerriAI/litellm/commit/9fa1a641119dd0d4fe43e93622eae5f482ceb63f","tags":[]},{"url":"https://github.com/BerriAI/litellm/commit/a80eacacee118fbed54e3d98f239d17a63fac818","tags":[]},{"url":"https://github.com/BerriAI/litellm/commit/f7cd90f09e9716652b38daec9f0640cdf49d582b","tags":[]},{"url":"https://github.com/BerriAI/litellm/releases/tag/v1.100.4","tags":[]},{"url":"https://github.com/BerriAI/litellm/releases/tag/v1.101.3","tags":[]},{"url":"https://github.com/BerriAI/litellm/releases/tag/v1.102.2","tags":[]},{"url":"https://github.com/BerriAI/litellm/releases/tag/v1.103.1","tags":[]},{"url":"https://github.com/BerriAI/litellm/releases/tag/v1.104.0-rc.2","tags":[]},{"url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-7hp6-4w63-5g45","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"PyPI","package":"litellm","vulnerableRanges":[">=1.91.0, <1.100.4",">=1.101.0, <1.101.3",">=1.102.0, <1.102.2",">=1.103.0, <1.103.1",">=1.104.0rc1, <1.104.0rc2"],"patched":["1.100.4","1.101.3","1.102.2","1.103.1","1.104.0rc2"],"from":["GHSA-7hp6-4w63-5g45"],"provenance":"source"}],"advisories":[{"id":"GHSA-7hp6-4w63-5g45","url":"https://github.com/advisories/GHSA-7hp6-4w63-5g45","severity":"HIGH","ecosystem":"PyPI","package":"litellm","vulnerableRanges":[">=1.91.0, <1.100.4"],"patched":["1.100.4"],"provenance":"source","from":"GHSA"},{"id":"GHSA-7hp6-4w63-5g45","url":"https://github.com/advisories/GHSA-7hp6-4w63-5g45","severity":"HIGH","ecosystem":"PyPI","package":"litellm","vulnerableRanges":[">=1.101.0, <1.101.3"],"patched":["1.101.3"],"provenance":"source","from":"GHSA"},{"id":"GHSA-7hp6-4w63-5g45","url":"https://github.com/advisories/GHSA-7hp6-4w63-5g45","severity":"HIGH","ecosystem":"PyPI","package":"litellm","vulnerableRanges":[">=1.102.0, <1.102.2"],"patched":["1.102.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-7hp6-4w63-5g45","url":"https://github.com/advisories/GHSA-7hp6-4w63-5g45","severity":"HIGH","ecosystem":"PyPI","package":"litellm","vulnerableRanges":[">=1.103.0, <1.103.1"],"patched":["1.103.1"],"provenance":"source","from":"GHSA"},{"id":"GHSA-7hp6-4w63-5g45","url":"https://github.com/advisories/GHSA-7hp6-4w63-5g45","severity":"HIGH","ecosystem":"PyPI","package":"litellm","vulnerableRanges":[">=1.104.0rc1, <1.104.0rc2"],"patched":["1.104.0rc2"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2026-108277","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108277","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-22","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114612","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":11.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":4.98,"detail":"percentile 0.2491"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.93,"detail":"base score 9.9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-berriai-litellm-cve-2024-6587","parents":[{"from":"CVE-2024-6587","to":"CVE-2026-114612","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["litellm/proxy/auth/auth_checks.py"],"commits":["https://github.com/berriai/litellm/commit/ba1912afd1b19e38d3704bb156adf887f91ae1e0","https://github.com/BerriAI/litellm/commit/1d5fdc87fed66b49e1df8cf7d708ad93249eb7d0","https://github.com/BerriAI/litellm/commit/9161d7f9d6073603ba61ee4aa5e2c0ef5b37a81b"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2026-49468","published":"2026-06-22","fixed":"1.84.0","kev":false},{"cve":"CVE-2026-59822","published":"2026-07-08","fixed":"1.84.0","kev":true},{"cve":"CVE-2026-84377","published":"2026-09-02","fixed":"1.96.2","kev":false,"link":{"from":"CVE-2026-84377","to":"CVE-2026-114612","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:litellm","fromFixed":"1.96.2","toFixed":"1.100.4","daysApart":50}]}},{"cve":"CVE-2026-114612","published":"2026-10-22","fixed":"1.104.0rc2","kev":false}],"package":"PyPI:litellm"}}