Cryptographic Context Reuse in LiteLLM AI Gateway by BerriAI
CVE-2026-114612
What is CVE-2026-114612?
LiteLLM, developed by BerriAI, is an AI Gateway that facilitates calls to LLM APIs. A vulnerability exists from versions 1.87.0 to version 1.104.0-rc.2 due to improper management of cryptographic contexts used for at-rest secrets and session tokens. This allows authenticated internal users to create manipulated metadata, including forged administrator credentials. These credentials, when replayed as bearer tokens, can be accepted by the proxy, granting unauthorized administrative access and enabling the execution of arbitrary commands via the MCP stdio endpoint. This issue is particularly concerning as versions prior to 1.91.0 require EXPERIMENTAL_UI_LOGIN to be enabled, while subsequent versions expose the vulnerability even in default settings. BerriAI has addressed this vulnerability in the later versions mentioned.
Affected Version(s)
litellm >= 1.87.0, < 1.100.4 < 1.87.0, 1.100.4
litellm >= 1.101.0, < 1.101.3 < 1.101.0, 1.101.3
litellm >= 1.102.0, < 1.102.2 < 1.102.0, 1.102.2