CVE-2026-114612

Name of the Vulnerable Software and Affected Versions LiteLLM versions 1.87.0 through 1.100.3 LiteLLM versions 1.101.0 through 1.101.2 LiteLLM versions 1.102.0 through 1.102.1 LiteLLM versions 1.103.0 LiteLLM versions 1.104.0-rc.0 through 1.104.0-rc.1

Description LiteLLM reuses a single cryptographic context for both at-rest secrets and session tokens. This allows an authenticated internal user to craft metadata containing a forged administrator credential, which the API-key flow then encrypts and returns. By replaying this ciphertext as a bearer token, the proxy accepts the forged administrator identity. This grants administrative access and the ability to execute arbitrary commands through the MCP stdio endpoint, as well as access to all upstream provider keys. In versions 1.87.0 through 1.90.x, this requires the EXPERIMENTAL UI LOGIN variable to be enabled, whereas versions after 1.91.0 are exploitable by default.

Recommendations Update to version 1.100.4, 1.101.3, 1.102.2, 1.103.1, or 1.104.0-rc.2.