CVE-2026-89032: BerriAI LiteLLM < 1.101.0-rc.1 Tenant Isolation Bypass via Semantic Cache Layer
BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other tenants' cached responses by exploiting a metadata key mismatch between getsemanticcachetenantscope() and getmetadatavariablename(). Attackers holding a valid virtual key can submit semantically similar prompts on affected routes such as /v1/responses and /bedrock/ to retrieve cached responses containing other tenants' personally identifiable information, financial data, or source code, and can cause agentic front-ends to auto-execute attacker-supplied tool calls under victim credentials by returning cached functioncall or toolcalls payloads to a different principal.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to cross-tenant data disclosure?
LiteLLM deployments before 1.101.0-rc.1 that use the semantic cache layer are affected. Exposure applies to affected routes including /v1/responses and /bedrock/* where multiple tenants can submit requests using valid virtual keys.
What does an attacker need to exploit this issue?
The attacker needs a valid virtual key and must submit prompts that are semantically similar to prompts whose responses are already cached for another tenant. Exploitation also requires the affected semantic-cache metadata key mismatch to be present.
What could an attacker retrieve or cause through a cache collision?
An attacker may retrieve cached responses from other tenants, including personally identifiable information, financial data, or source code. Cached function_call or tool_calls payloads returned to a different principal may also lead agentic front ends to automatically execute attacker-supplied tool calls under victim credentials.
What can be done if upgrading is not immediately possible?
The provided information identifies the semantic cache layer as the affected component, but does not document a specific workaround. Practitioners should prioritize upgrading to 1.101.0-rc.1 or later and assess whether semantic caching is enabled on the affected routes while remediation is pending.