Read the docs
TI-2026-79419 Aliases CVE-2026-114612GHSA-7hp6-4w63-5g45

Privilege escalation to proxy admin in LiteLLM via reused salt key

Priority MEDIUM 43CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation, Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-269 and CWE-345.

Summary

LiteLLM, an AI gateway proxy server, is affected from 1.87.0 before 1.100.4, from 1.101.0 before 1.101.3, from 1.102.0 before 1.102.2, from 1.103.0 before 1.103.1, and from 1.104.0-rc.1 before 1.104.0-rc.2. The proxy reuses one cryptographic context for at-rest secrets and session tokens, so an authenticated internal user can obtain a forged administrator credential encrypted and returned by the API-key flow (CWE-345). Replaying that ciphertext as a bearer token gives the attacker proxy administrator access and lets them run arbitrary commands through the MCP stdio endpoint.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow. Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require EXPERIMENTAL_UI_LOGIN to be enabled, while versions after 1.91.0 are exploitable in the default configuration. This issue was fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00319 25th percentileScored 2026-11-07
Fix Fixed litellm (BerriAI): 1.100.4, 1.101.3, 1.102.2 +2litellm (PyPI): 1.100.4, 1.101.3, 1.102.2 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BerriAIlitellm1.87.0 to before 1.100.4; 1.101.0 to before 1.101.3; 1.102.0 to before 1.102.2; 1.103.0 to before 1.103.1; 1.104.0-rc.1 to before 1.104.0-rc.21.100.4, 1.101.3, 1.102.2, 1.103.1, 1.104.0-rc.2Patch availableCNA
—litellm (PyPI)1.91.0 to before 1.100.41.100.4Patch availableGHSA-7hp6-4w63-5g45
—litellm (PyPI)1.101.0 to before 1.101.31.101.3Patch availableGHSA-7hp6-4w63-5g45
—litellm (PyPI)1.102.0 to before 1.102.21.102.2Patch availableGHSA-7hp6-4w63-5g45
—litellm (PyPI)1.103.0 to before 1.103.11.103.1Patch availableGHSA-7hp6-4w63-5g45
—litellm (PyPI)1.104.0rc1 to before 1.104.0rc21.104.0rc2Patch availableGHSA-7hp6-4w63-5g45
  • litellm VendorBerriAI Affected 1.87.0 to before 1.100.4; 1.101.0 to before 1.101.3; 1.102.0 to before 1.102.2; 1.103.0 to before 1.103.1; 1.104.0-rc.1 to before 1.104.0-rc.2 Fixed in 1.100.4, 1.101.3, 1.102.2, 1.103.1, 1.104.0-rc.2 Patch available CNA
  • litellm (PyPI) Vendor— Affected 1.91.0 to before 1.100.4 Fixed in 1.100.4 Patch available GHSA-7hp6-4w63-5g45
  • litellm (PyPI) Vendor— Affected 1.101.0 to before 1.101.3 Fixed in 1.101.3 Patch available GHSA-7hp6-4w63-5g45
  • litellm (PyPI) Vendor— Affected 1.102.0 to before 1.102.2 Fixed in 1.102.2 Patch available GHSA-7hp6-4w63-5g45
  • litellm (PyPI) Vendor— Affected 1.103.0 to before 1.103.1 Fixed in 1.103.1 Patch available GHSA-7hp6-4w63-5g45
  • litellm (PyPI) Vendor— Affected 1.104.0rc1 to before 1.104.0rc2 Fixed in 1.104.0rc2 Patch available GHSA-7hp6-4w63-5g45

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:*——BerriAI
  • cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:* Versions — — ·BerriAI

Remediation

Upgrade the litellm package to 1.100.4, 1.101.3, 1.102.2, 1.103.1, or 1.104.0-rc.2, the fixed version for each affected release line.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA litellm (BerriAI) Fixed in 1.100.4, 1.101.3, 1.102.2, 1.103.1, 1.104.0-rc.2
  • Fix · GHSA-7hp6-4w63-5g45 litellm (PyPI) Fixed in 1.100.4 Advisory →
  • Fix · GHSA-7hp6-4w63-5g45 litellm (PyPI) Fixed in 1.101.3 Advisory →
  • Fix · GHSA-7hp6-4w63-5g45 litellm (PyPI) Fixed in 1.102.2 Advisory →
  • Fix · GHSA-7hp6-4w63-5g45 litellm (PyPI) Fixed in 1.103.1 Advisory →
  • Fix · GHSA-7hp6-4w63-5g45 litellm (PyPI) Fixed in 1.104.0rc2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

Not affected: 4 products
  • Exploit Intelligence
  • Lightspeed Core
  • Red Hat Ansible Automation Platform 2
  • Red Hat OpenShift AI (RHOAI)

Timeline

  1. 2026-10-22 Threatist record created from CVE-2026-114612
  2. 2026-10-24 Affected versions changed · Red Hat
  3. 2026-10-24 CVSS score added · Red Hat
  4. 2026-10-27 Alias added: GHSA-7hp6-4w63-5g45
  5. 2026-10-30 CISA SSVC decision points changed

References

Advisory 1

Other 12

  • TI-2026-26015 Trivy ecosystem supply chain briefly compromised KEVCVSS 4.0CRITICAL 9.4
  • TI-2026-30529 LiteLLM: SQL injection in Proxy API key verification KEVCVSS 4.0CRITICAL 9.3
  • TI-2026-30582 LiteLLM: Authenticated command execution via MCP stdio test endpoints KEVCVSS 4.0HIGH 8.7
  • TI-2026-42639 LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback KEVCVSS 4.0HIGH 8.8
  • TI-2024-05340 Remote Code Execution in BerriAI/litellm CVSS 3.1CRITICAL 9.8
  • TI-2024-03969 Remote Code Execution in berriai/litellm CVSS 3.0CRITICAL 9.8
See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences