Live › vulnerability › CVE-2026-114612
Go to dashboardLiteLLM reuses one cryptographic context for stored secrets and session tokens, so an authenticated internal user can get a forged administrator credential back from the API-key flow. Replaying that credential as a bearer token gives administrative access and arbitrary commands through the MCP stdio endpoint.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
1.87.0 through 1.100.4, or in the 1.101, 1.102, or 1.103 branches below their fixed releases1.87.0 to 1.90.x are exposed only with EXPERIMENTAL_UI_LOGIN enabled; later affected versions are exposed in the default configuration1.100.4, 1.101.3, 1.102.2, 1.103.1, or 1.104.0-rc.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow. Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require EXPERIMENTAL_UI_LOGIN to be enabled, while versions after 1.91.0 are exploitable in the default configuration. This issue was fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-114612")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.