{"id":"CVE-2026-114612","summary":"LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key","details":"LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow. Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require EXPERIMENTAL_UI_LOGIN to be enabled, while versions after 1.91.0 are exploitable in the default configuration. This issue was fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2.","aliases":["GHSA-7hp6-4w63-5g45"],"modified":"2026-10-23T02:46:28.680261548Z","published":"2026-10-22T18:01:52.768Z","database_specific":{"cwe_ids":["CWE-269","CWE-345","CWE-441"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114612.json","cna_assigner":"GitHub_M"},"references":[{"type":"FIX","url":"https://github.com/BerriAI/litellm/commit/1d5fdc87fed66b49e1df8cf7d708ad93249eb7d0"},{"type":"FIX","url":"https://github.com/BerriAI/litellm/commit/9161d7f9d6073603ba61ee4aa5e2c0ef5b37a81b"},{"type":"FIX","url":"https://github.com/BerriAI/litellm/commit/9fa1a641119dd0d4fe43e93622eae5f482ceb63f"},{"type":"FIX","url":"https://github.com/BerriAI/litellm/commit/a80eacacee118fbed54e3d98f239d17a63fac818"},{"type":"FIX","url":"https://github.com/BerriAI/litellm/commit/f7cd90f09e9716652b38daec9f0640cdf49d582b"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/releases/tag/v1.100.4"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/releases/tag/v1.101.3"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/releases/tag/v1.102.2"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/releases/tag/v1.103.1"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/releases/tag/v1.104.0-rc.2"},{"type":"ADVISORY","url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-7hp6-4w63-5g45"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114612.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114612"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/berriai/litellm","events":[{"introduced":"fa3fc7a91cac8fec7457db2aa5a4f4f8380c608c"},{"fixed":"883282fb72f31ab90a0ba828a10bbfe7d2680805"},{"introduced":"18243cd7af4c3325165ba68b21379e2719e051c7"},{"fixed":"1b6ee737c96c346430b04f36827fbe64935328df"},{"introduced":"95293834e833b2d2979f87d1bd2a5be45db6728a"},{"fixed":"a0c4a3347afe19decf500ecf436f21d7fb471c34"},{"introduced":"c991f4b01f5799eb0b0cab0fb63988e15c3a8a9d"},{"fixed":"580bde9a2d148714889ec1c04a9872819e78a778"},{"introduced":"a76395ec70c654aac62db8d8340579596543e3e3"},{"fixed":"e926084212ab2eb234c58840d741b3c62c35911b"},{"fixed":"1d5fdc87fed66b49e1df8cf7d708ad93249eb7d0"},{"fixed":"9161d7f9d6073603ba61ee4aa5e2c0ef5b37a81b"},{"fixed":"9fa1a641119dd0d4fe43e93622eae5f482ceb63f"},{"fixed":"a80eacacee118fbed54e3d98f239d17a63fac818"},{"fixed":"f7cd90f09e9716652b38daec9f0640cdf49d582b"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"1.87.0"},{"fixed":"1.100.4"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"strategy":"StringRangeExpression","range":[{"introduced":"1.101.0"},{"fixed":"1.101.3"}],"source":"AFFECTED_FIELD"},{"strategy":"StringRangeExpression","range":[{"introduced":"1.102.0"},{"fixed":"1.102.2"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"1.103.0"},{"fixed":"1.103.1"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"range":[{"introduced":"1.104.0-rc.1"},{"fixed":"1.104.0-rc.2"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"1d5fdc87fed66b49e1df8cf7d708ad93249eb7d0"}]},{"range":[{"fixed":"9161d7f9d6073603ba61ee4aa5e2c0ef5b37a81b"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"9fa1a641119dd0d4fe43e93622eae5f482ceb63f"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"a80eacacee118fbed54e3d98f239d17a63fac818"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"f7cd90f09e9716652b38daec9f0640cdf49d582b"}],"source":"REFERENCES_COMMIT"},{"original_tag":"v1.100.4","range":[{"fixed":"883282fb72f31ab90a0ba828a10bbfe7d2680805"}],"source":"REFERENCES_TAG"},{"range":[{"fixed":"1b6ee737c96c346430b04f36827fbe64935328df"}],"source":"REFERENCES_TAG","original_tag":"v1.101.3"},{"original_tag":"v1.102.2","range":[{"fixed":"a0c4a3347afe19decf500ecf436f21d7fb471c34"}],"source":"REFERENCES_TAG"},{"source":"REFERENCES_TAG","original_tag":"v1.103.1","range":[{"fixed":"580bde9a2d148714889ec1c04a9872819e78a778"}]},{"original_tag":"v1.104.0-rc.2","range":[{"fixed":"e926084212ab2eb234c58840d741b3c62c35911b"}],"source":"REFERENCES_TAG"}]}}],"versions":["v1.101.2","v1.103.0","v1.102.1","v1.104.0-rc.1","v1.101.1","v1.102.0","v1.101.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114612.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}