Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114612— LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key

Quick assessment

Affected
BerriAI litellm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

LiteLLM 是一个代理服务器（AI 网关），用于以 OpenAI（或原生）格式调用大语言模型（LLM）API。在版本 1.87.0 至 1.100.4、1.101.3、1.102.2、1.103.1 以及 1.104.0-rc.2 中，该代理为静态存储的秘密和会话令牌复用了同一个加密上下文。这使得经过身份验证的内部用户可以构造包含伪造管理员凭据的元数据，并通过 API 密钥流程将其加密后返回。攻击者若将该密文作为 Bearer Token 重放，代理便会信任该伪造的代理管理员身份，从而允许其获得管理员权限，并通

CVSS 9.9 · Critical

Affected Version Matrix 5

VendorProduct Version RangeStatus
BerriAI litellm >= 1.87.0, < 1.100.4 affected
>= 1.101.0, < 1.101.3 affected
>= 1.102.0, < 1.102.2 affected
>= 1.103.0, < 1.103.1 affected
>= 1.104.0-rc.1, < 1.104.0-rc.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-114612

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
Source: CVE Program / CVE List V5
Vulnerability Description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow. Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require EXPERIMENTAL_UI_LOGIN to be enabled, while versions after 1.91.0 are exploitable in the default configuration. This issue was fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
BerriAI litellm >= 1.87.0, < 1.100.4 -

II. Public POCs for CVE-2026-114612

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114612

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-114612 (3)

Vendor Advisories for CVE-2026-114612 (1)

Vendor Pages for CVE-2026-114612 (4)

IV. Related Vulnerabilities

Same product: litellm
Same vendor: BerriAI
Same weakness: CWE-269

V. Comments for CVE-2026-114612

No comments yet

Leave a comment