BerriAI · litellm
LiteLLM's proxy server, an AI Gateway for calling LLM APIs, reuses a single cryptographic context for both at-rest secrets and session tokens, so an authenticated internal user can craft metadata that yields a forged administrator credential through the API-key flow. An attacker with low-privilege authenticated access and no user interaction can replay that forged credential as a bearer token to gain administrative access and run arbitrary commands via the MCP stdio endpoint, with versions 1.87.0 through 1.90.x additionally requiring EXPERIMENTAL_UI_LOGIN to be enabled.
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow. Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require EXPERIMENTAL_UI_LOGIN to be enabled, while versions after 1.91.0 are exploitable in the default configuration. This issue was fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2.
Disclosed on 22 Oct 2026. No public exploit code or confirmed exploitation is recorded.
2 related vulnerabilities in the same code over 2 years. The latest fix listed for litellm is 1.104.0rc2.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: litellm.
Upgrade to 1.103.1
Also affected, despite being newer: 1.104.0rc1 up to 1.104.0rc2.
pip install "litellm>=1.103.1"The first fix for CVE-2026-114612.
| If you run | Upgrade to |
|---|---|
| 1.104.0rc1 up to 1.104.0rc2 | 1.104.0rc2 |
| 1.103.0 up to 1.103.1 | 1.103.1 |
| 1.102.0 up to 1.102.2 | 1.102.2 |
| 1.101.0 up to 1.101.3 | 1.101.3 |
| 1.91.0 up to 1.100.4 | 1.100.4 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.