CVE-2026-114612criticalBroken access control2026-10-22

CVE-2026-114612: LiteLLM proxy lets an internal user forge an admin token and run commands

The LiteLLM proxy used one encryption key both to seal secrets at rest and to mint session tokens. A user with internal_user rights can get the proxy to encrypt a forged admin credential through the API-key flow, replay it as a bearer token, become proxy admin and run arbitrary commands through the MCP stdio endpoint. Versions from 1.91.0 are exploitable in the default configuration.

01.

What it is

When creating a new API key, an attacker puts a forged proxy-admin credential in a crafted metadata field as the 'secret' value. The proxy encrypts it with the same key it uses for session tokens and returns the ciphertext.

Presenting that ciphertext as a bearer token makes the proxy decrypt it and trust the forged proxy_admin identity, which gives full administrative access, including running arbitrary commands on the host through the MCP stdio endpoint.

Versions 1.87.0 through 1.90.x are only exploitable when EXPERIMENTAL_UI_LOGIN=true is set; later affected versions are exploitable in the default configuration.

02.

How to check

Affected: litellm (PyPI) from 1.87.0 before 1.100.4, 1.101.x before 1.101.3, 1.102.x before 1.102.2, 1.103.x before 1.103.1, and 1.104.0rc1.
You are most exposed if you run the LiteLLM proxy with internal users or teams who aren't fully trusted admins.

03.

How to fix

Upgrade litellm to 1.100.4, 1.101.3, 1.102.2, 1.103.1 or 1.104.0rc2 or later.
If you can't upgrade right away, set EXPERIMENTAL_UI_LOGIN=false. The advisory says this closes the vulnerable path but breaks CLI SSO and Claude Code gateway login.

pip show litellm | grep -i version

04.

Sources

More advisories for this tool