CVE-2026-114612

LiteLLM encryption-key reuse enables administrator impersonation

BerriAI · LiteLLM proxy

First documented disclosure · Review checkpoint

Summary

A low-privilege internal user could obtain a forged administrator session and invoke privileged MCP commands.

Severity and exploitation evidence

Critical · 9.9/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed sources do not establish malicious exploitation. A published proof of concept is not evidence of a customer compromise.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The proxy reused one cryptographic context for stored secrets and session tokens.

Conditions required

An internal user account; 1.87.0–1.90.x additionally requires experimental UI login. Later affected versions expose the path by default.

Potential impact

Administrative takeover and potential host command execution.

Affected versions and configurations

1.87.0–before 1.100.4; 1.101.x before .3; 1.102.x before .2; 1.103.x before .1; 1.104.0-rc.1.

Fix and mitigation status

1.100.4, 1.101.3, 1.102.2, 1.103.1, or 1.104.0-rc.2 on the appropriate branch.

Practical next steps

Upgrade; the advisory offers disabling experimental UI login as a temporary mitigation, with CLI SSO and Claude Code gateway-login disruption.

Operating lesson

Separate encryption and token-signing contexts so one interface cannot mint authority for another.

Evidence and limits

Upstream disclosure was September 30; October 22 is CVE publication. Branch-specific fixes should not be collapsed into one minimum version.

Sources