---
id: "CVE-2026-114612"
kind: "vulnerability"
aliases: ["CVE-2026-114612"]
title: "LiteLLM: forged admin token gives proxy admin and MCP command execution"
severity: "critical"
cvss: 9.9
epss: 0.00235
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "ai-gateway", "litellm", "poc-public", "mcp", "python", "self-hosted"]
not_affected_if: ["patched-releases", "pre-1.87.0"]
published_at: "2026-10-22T19:17:37+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-24T15:23:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114612", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114612", "first_seen_at": "2026-10-24T07:15:51+00:00"}, {"source": "github-poc", "url": "https://github.com/Hunt-Benito/one-salt-to-forge-them-all-cve-2026-114612-forged-admin-session-in-litellm", "first_seen_at": "2026-10-24T15:23:20+00:00"}]
---

# LiteLLM: forged admin token gives proxy admin and MCP command execution

LiteLLM reuses one cryptographic context for stored secrets and session tokens, so an authenticated internal user can get a forged administrator credential back from the API-key flow. Replaying that credential as a bearer token gives administrative access and arbitrary commands through the MCP stdio endpoint.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check whether the installed LiteLLM version falls in 1.87.0 through 1.100.4, or in the 1.101, 1.102, or 1.103 branches below their fixed releases. Versions 1.87.0 to 1.90.x are exposed only with EXPERIMENTAL_UI_LOGIN enabled; later affected versions are exposed in the default configuration. Whether the MCP stdio endpoint is reachable from your network is unknown from the sources.

## Fix

Upgrade to 1.100.4, 1.101.3, 1.102.2, 1.103.1, or 1.104.0-rc.2 or later. Rotating credentials after upgrading is unknown from the sources.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114612
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114612
- 2026-10-24T15:23:20+00:00 github-poc https://github.com/Hunt-Benito/one-salt-to-forge-them-all-cve-2026-114612-forged-admin-session-in-litellm

## Documents

- [poc] Hunt-Benito/one-salt-to-forge-them-all-cve-2026-114612-forged-admin-session-in-litellm https://github.com/Hunt-Benito/one-salt-to-forge-them-all-cve-2026-114612-forged-admin-session-in-litellm

## From the sources

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow. Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require EXPERIMENTAL_UI_LOGIN to be enabled, while versions after 1.91.0 are exploitable in the default configuration. This issue was fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_