CVE-2026-114612
Description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow. Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require EXPERIMENTAL_UI_LOGIN to be enabled, while versions after 1.91.0 are exploitable in the default configuration. This issue was fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2.
How to fix
- litellm1.100.4, 1.101.3, 1.102.2, 1.103.1, 1.104.0rc2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| litellmPyPI | 1.91.0 ≤ v < 1.100.4, 1.101.0 ≤ v < 1.101.3, 1.102.0 ≤ v < 1.102.2, 1.103.0 ≤ v < 1.103.1, 1.104.0rc1 ≤ v < 1.104.0rc2 | 1.100.4, 1.101.3, 1.102.2, 1.103.1, 1.104.0rc2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.