CVE-2026-114612: LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow. Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require EXPERIMENTALUILOGIN to be enabled, while versions after 1.91.0 are exploitable in the default configuration. This issue was fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LiteLLMto a version that resolves this vulnerability.Fixed in 1.100.4
Event History
Frequently Asked Questions
Which deployments are exposed by default?
LiteLLM versions after 1.91.0 in the affected ranges are exploitable in the default configuration. Versions 1.87.0 through 1.90.x require EXPERIMENTAL_UI_LOGIN to be enabled.
What level of access does an attacker need?
An attacker must be an authenticated internal user. They need to submit crafted metadata through the API-key flow, obtain the resulting encrypted credential, and replay it as a bearer token.
What access can successful exploitation provide?
Successful exploitation causes the proxy to trust a forged proxy administrator identity. This grants administrative access and permits arbitrary commands through the MCP stdio endpoint.
Which versions contain fixes?
The issue is fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2.