{"id":"CVE-2026-114612","kind":"vulnerability","aliases":["CVE-2026-114612"],"related":[],"title":"LiteLLM: forged admin token gives proxy admin and MCP command execution","description":"LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow. Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require EXPERIMENTAL_UI_LOGIN to be enabled, while versions after 1.91.0 are exploitable in the default configuration. This issue was fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2.","summary":"LiteLLM reuses one cryptographic context for stored secrets and session tokens, so an authenticated internal user can get a forged administrator credential back from the API-key flow. Replaying that credential as a bearer token gives administrative access and arbitrary commands through the MCP stdio endpoint.","severity":"critical","cvss":9.9,"epss":0.00235,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","ai-gateway","litellm","poc-public","mcp","python","self-hosted"],"not_affected_if":["patched-releases","pre-1.87.0"],"how_to_check":"Check whether the installed LiteLLM version falls in 1.87.0 through 1.100.4, or in the 1.101, 1.102, or 1.103 branches below their fixed releases. Versions 1.87.0 to 1.90.x are exposed only with EXPERIMENTAL_UI_LOGIN enabled; later affected versions are exposed in the default configuration. Whether the MCP stdio endpoint is reachable from your network is unknown from the sources.","fix":"Upgrade to 1.100.4, 1.101.3, 1.102.2, 1.103.1, or 1.104.0-rc.2 or later. Rotating credentials after upgrading is unknown from the sources.","status":"open","published_at":"2026-10-22T19:17:37+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-23T22:32:19+00:00","updated_at":"2026-10-24T15:23:20+00:00","category":"ai-tooling","confidence":0.9,"triage":{"at":"2026-10-23T22:32:19Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to 1.100.4, 1.101.3, 1.102.2, 1.103.1, or 1.104.0-rc.2 or later. Rotating credentials after upgrading is unknown from the sources.","reach":"network","title":"LiteLLM: forged admin token gives proxy admin and MCP command execution","impact":"high","summary":"LiteLLM reuses one cryptographic context for stored secrets and session tokens, so an authenticated internal user can get a forged administrator credential back from the API-key flow. Replaying that credential as a bearer token gives administrative access and arbitrary commands through the MCP stdio endpoint.","category":"ai-tooling","who_cares":["litellm","ai-gateway","mcp","python","self-hosted"],"confidence":0.9,"needs_auth":"yes","worst_case":"Authenticated user becomes proxy admin and runs arbitrary commands","analyst_note":"Confirm from the NVD entry and the LiteLLM advisory whether the MCP stdio endpoint is exposed by default and how to detect prior exploitation (https://nvd.nist.gov/vuln/detail/CVE-2026-114612).","how_to_check":"Check whether the installed LiteLLM version falls in 1.87.0 through 1.100.4, or in the 1.101, 1.102, or 1.103 branches below their fixed releases. Versions 1.87.0 to 1.90.x are exposed only with EXPERIMENTAL_UI_LOGIN enabled; later affected versions are exposed in the default configuration. Whether the MCP stdio endpoint is reachable from your network is unknown from the sources.","needs_analyst":true,"not_affected_if":["pre-1.87.0","patched-releases"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.001214,"input_tokens":3189,"output_tokens":1790,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-114612':14A,17A '-2026':13A,16A '1.100.4':99C,199C '1.101.3':100C,200C '1.102.2':101C,201C '1.103.1':102C,202C '1.104.0':104C,204C '1.87.0':97C,172C '1.90':174C '1.91.0':186C 'access':71B,162C 'admin':3A,7A 'administr':53B,70B,132C,158C,161C 'ai':19B,22B,85C 'ai-gateway':21B 'ai-tool':18B 'allow':120C 'api':59B,90C,140C 'api-key':58B,139C 'arbitrari':73B,164C 'at-rest':113C 'authent':46B,122C 'back':55B 'bearer':67B,148C 'call':88C 'caus':150C 'ciphertext':145C 'command':10A,74B,165C 'configur':192C 'contain':129C 'context':37B,111C 'craft':127C 'credenti':54B,64B,133C 'cryptograph':36B,110C 'cve':12A,15A 'default':191C 'enabl':182C 'encrypt':134C 'endpoint':79B,170C 'execut':11A 'experiment':177C 'exploit':188C 'fix':196C 'flow':61B,142C 'forg':2A,52B,131C,156C 'format':95C 'gateway':23B,86C 'get':50B 'give':5A,69B 'host':32B 'ident':159C 'intern':47B,123C 'issu':194C 'key':60B,141C 'litellm':1A,24B,33B,80C,198C 'llm':89C 'login':179C 'mcp':9A,28B,77B,168C 'metadata':128C 'nativ':94C 'one':35B,109C 'openai':92C 'permit':160C 'poc':26B 'poc-publ':25B 'proxi':6A,83C,107C,152C,157C 'public':27B 'python':29B 'rc.2':105C,205C 'replay':62B,143C 'requir':176C 'rest':115C 'return':136C 'reus':34B,108C 'secret':40B,116C 'self':31B 'self-host':30B 'server':84C 'session':42B,118C 'stdio':78B,169C 'store':39B 'token':4A,43B,68B,119C,149C 'tool':20B 'trust':154C 'ui':178C 'user':48B,124C 'version':171C,184C 'x':175C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-114612","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114612","severity":null,"published_at":"2026-10-22T19:17:37+00:00","modified_at":"2026-10-23T19:42:24+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114612","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114612","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null},{"source":"github-poc","external_id":"Hunt-Benito/one-salt-to-forge-them-all-cve-2026-114612-forged-admin-session-in-litellm","url":"https://github.com/Hunt-Benito/one-salt-to-forge-them-all-cve-2026-114612-forged-admin-session-in-litellm","severity":null,"published_at":"2026-10-24T15:18:04+00:00","modified_at":null,"first_seen_at":"2026-10-24T15:23:20+00:00","fetched_at":"2026-10-24T15:23:20+00:00","note":null}],"documents":[{"id":2783,"url":"https://github.com/Hunt-Benito/one-salt-to-forge-them-all-cve-2026-114612-forged-admin-session-in-litellm","title":"Hunt-Benito/one-salt-to-forge-them-all-cve-2026-114612-forged-admin-session-in-litellm","kind":"poc","source":"github","text":"\n\nstars 0","published_at":"2026-10-24T15:18:04+00:00","relation":"poc","confidence":null,"note":"0 stars"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}