CVE-2026-114612

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-114612", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-21T20:34:25.599Z", "datePublished": "2026-10-22T18:01:52.768Z", "dateUpdated": "2026-10-30T18:17:34.432Z"}, "containers": {"cna": {"title": "LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key", "problemTypes": [{"descriptions": [{"cweId": "CWE-269", "lang": "en", "description": "CWE-269: Improper Privilege Management", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-345", "lang": "en", "description": "CWE-345: Insufficient Verification of Data Authenticity", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-441", "lang": "en", "description": "CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/BerriAI/litellm/security/advisories/GHSA-7hp6-4w63-5g45", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/BerriAI/litellm/security/advisories/GHSA-7hp6-4w63-5g45"}, {"name": "https://github.com/BerriAI/litellm/commit/1d5fdc87fed66b49e1df8cf7d708ad93249eb7d0", "tags": ["x_refsource_MISC"], "url": "https://github.com/BerriAI/litellm/commit/1d5fdc87fed66b49e1df8cf7d708ad93249eb7d0"}, {"name": "https://github.com/BerriAI/litellm/commit/9161d7f9d6073603ba61ee4aa5e2c0ef5b37a81b", "tags": ["x_refsource_MISC"], "url": "https://github.com/BerriAI/litellm/commit/9161d7f9d6073603ba61ee4aa5e2c0ef5b37a81b"}, {"name": "https://github.com/BerriAI/litellm/commit/9fa1a641119dd0d4fe43e93622eae5f482ceb63f", "tags": ["x_refsource_MISC"], "url": "https://github.com/BerriAI/litellm/commit/9fa1a641119dd0d4fe43e93622eae5f482ceb63f"}, {"name": "https://github.com/BerriAI/litellm/commit/a80eacacee118fbed54e3d98f239d17a63fac818", "tags": ["x_refsource_MISC"], "url": "https://github.com/BerriAI/litellm/commit/a80eacacee118fbed54e3d98f239d17a63fac818"}, {"name": "https://github.com/BerriAI/litellm/commit/f7cd90f09e9716652b38daec9f0640cdf49d582b", "tags": ["x_refsource_MISC"], "url": "https://github.com/BerriAI/litellm/commit/f7cd90f09e9716652b38daec9f0640cdf49d582b"}, {"name": "https://github.com/BerriAI/litellm/releases/tag/v1.100.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/BerriAI/litellm/releases/tag/v1.100.4"}, {"name": "https://github.com/BerriAI/litellm/releases/tag/v1.101.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/BerriAI/litellm/releases/tag/v1.101.3"}, {"name": "https://github.com/BerriAI/litellm/releases/tag/v1.102.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/BerriAI/litellm/releases/tag/v1.102.2"}, {"name": "https://github.com/BerriAI/litellm/releases/tag/v1.103.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/BerriAI/litellm/releases/tag/v1.103.1"}, {"name": "https://github.com/BerriAI/litellm/releases/tag/v1.104.0-rc.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/BerriAI/litellm/releases/tag/v1.104.0-rc.2"}], "affected": [{"vendor": "BerriAI", "product": "litellm", "versions": [{"version": ">= 1.87.0, < 1.100.4", "status": "affected"}, {"version": ">= 1.101.0, < 1.101.3", "status": "affected"}, {"version": ">= 1.102.0, < 1.102.2", "status": "affected"}, {"version": ">= 1.103.0, < 1.103.1", "status": "affected"}, {"version": ">= 1.104.0-rc.1, < 1.104.0-rc.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-22T18:01:52.768Z"}, "descriptions": [{"lang": "en", "value": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow. Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require EXPERIMENTAL_UI_LOGIN to be enabled, while versions after 1.91.0 are exploitable in the default configuration. This issue was fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2."}], "source": {"advisory": "GHSA-7hp6-4w63-5g45", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T18:17:23.322633Z", "id": "CVE-2026-114612", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T18:17:34.432Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-114612", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-21T20:34:25.599Z", "datePublished": "2026-10-22T18:01:52.768Z", "dateUpdated": "2026-10-30T18:17:34.432Z"}, "containers": {"cna": {"title": "LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key", "problemTypes": [{"descriptions": [{"cweId": "CWE-269", "lang": "en", "description": "CWE-269: Improper Privilege Management", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-345", "lang": "en", "description": "CWE-345: Insufficient Verification of Data Authenticity", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-441", "lang": "en", "description": "CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/BerriAI/litellm/security/advisories/GHSA-7hp6-4w63-5g45", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/BerriAI/litellm/security/advisories/GHSA-7hp6-4w63-5g45"}, {"name": "https://github.com/BerriAI/litellm/commit/1d5fdc87fed66b49e1df8cf7d708ad93249eb7d0", "tags": ["x_refsource_MISC"], "url": "https://github.com/BerriAI/litellm/commit/1d5fdc87fed66b49e1df8cf7d708ad93249eb7d0"}, {"name": "https://github.com/BerriAI/litellm/commit/9161d7f9d6073603ba61ee4aa5e2c0ef5b37a81b", "tags": ["x_refsource_MISC"], "url": "https://github.com/BerriAI/litellm/commit/9161d7f9d6073603ba61ee4aa5e2c0ef5b37a81b"}, {"name": "https://github.com/BerriAI/litellm/commit/9fa1a641119dd0d4fe43e93622eae5f482ceb63f", "tags": ["x_refsource_MISC"], "url": "https://github.com/BerriAI/litellm/commit/9fa1a641119dd0d4fe43e93622eae5f482ceb63f"}, {"name": "https://github.com/BerriAI/litellm/commit/a80eacacee118fbed54e3d98f239d17a63fac818", "tags": ["x_refsource_MISC"], "url": "https://github.com/BerriAI/litellm/commit/a80eacacee118fbed54e3d98f239d17a63fac818"}, {"name": "https://github.com/BerriAI/litellm/commit/f7cd90f09e9716652b38daec9f0640cdf49d582b", "tags": ["x_refsource_MISC"], "url": "https://github.com/BerriAI/litellm/commit/f7cd90f09e9716652b38daec9f0640cdf49d582b"}, {"name": "https://github.com/BerriAI/litellm/releases/tag/v1.100.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/BerriAI/litellm/releases/tag/v1.100.4"}, {"name": "https://github.com/BerriAI/litellm/releases/tag/v1.101.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/BerriAI/litellm/releases/tag/v1.101.3"}, {"name": "https://github.com/BerriAI/litellm/releases/tag/v1.102.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/BerriAI/litellm/releases/tag/v1.102.2"}, {"name": "https://github.com/BerriAI/litellm/releases/tag/v1.103.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/BerriAI/litellm/releases/tag/v1.103.1"}, {"name": "https://github.com/BerriAI/litellm/releases/tag/v1.104.0-rc.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/BerriAI/litellm/releases/tag/v1.104.0-rc.2"}], "affected": [{"vendor": "BerriAI", "product": "litellm", "versions": [{"version": ">= 1.87.0, < 1.100.4", "status": "affected"}, {"version": ">= 1.101.0, < 1.101.3", "status": "affected"}, {"version": ">= 1.102.0, < 1.102.2", "status": "affected"}, {"version": ">= 1.103.0, < 1.103.1", "status": "affected"}, {"version": ">= 1.104.0-rc.1, < 1.104.0-rc.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-22T18:01:52.768Z"}, "descriptions": [{"lang": "en", "value": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow. Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require EXPERIMENTAL_UI_LOGIN to be enabled, while versions after 1.91.0 are exploitable in the default configuration. This issue was fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2."}], "source": {"advisory": "GHSA-7hp6-4w63-5g45", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-114612", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-30T18:17:23.322633Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T18:17:27.306Z"}}]}}

{"affected": [{"affectedData": [{"product": "litellm", "vendor": "BerriAI", "versions": [{"status": "affected", "version": ">= 1.87.0, < 1.100.4"}, {"status": "affected", "version": ">= 1.101.0, < 1.101.3"}, {"status": "affected", "version": ">= 1.102.0, < 1.102.2"}, {"status": "affected", "version": ">= 1.103.0, < 1.103.1"}, {"status": "affected", "version": ">= 1.104.0-rc.1, < 1.104.0-rc.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow. Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require EXPERIMENTAL_UI_LOGIN to be enabled, while versions after 1.91.0 are exploitable in the default configuration. This issue was fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2."}], "id": "CVE-2026-114612", "lastModified": "2026-10-30T19:18:11.367", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-114612", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T18:17:23.322633Z", "version": "2.0.3"}}]}, "published": "2026-10-22T19:17:37.540", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/BerriAI/litellm/commit/1d5fdc87fed66b49e1df8cf7d708ad93249eb7d0"}, {"source": "security-advisories@github.com", "url": "https://github.com/BerriAI/litellm/commit/9161d7f9d6073603ba61ee4aa5e2c0ef5b37a81b"}, {"source": "security-advisories@github.com", "url": "https://github.com/BerriAI/litellm/commit/9fa1a641119dd0d4fe43e93622eae5f482ceb63f"}, {"source": "security-advisories@github.com", "url": "https://github.com/BerriAI/litellm/commit/a80eacacee118fbed54e3d98f239d17a63fac818"}, {"source": "security-advisories@github.com", "url": "https://github.com/BerriAI/litellm/commit/f7cd90f09e9716652b38daec9f0640cdf49d582b"}, {"source": "security-advisories@github.com", "url": "https://github.com/BerriAI/litellm/releases/tag/v1.100.4"}, {"source": "security-advisories@github.com", "url": "https://github.com/BerriAI/litellm/releases/tag/v1.101.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/BerriAI/litellm/releases/tag/v1.102.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/BerriAI/litellm/releases/tag/v1.103.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/BerriAI/litellm/releases/tag/v1.104.0-rc.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/BerriAI/litellm/security/advisories/GHSA-7hp6-4w63-5g45"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}, {"lang": "en", "value": "CWE-345"}, {"lang": "en", "value": "CWE-441"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "litellm: LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key", "id": "2559212", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559212"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-290", "details": ["LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow. Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require EXPERIMENTAL_UI_LOGIN to be enabled, while versions after 1.91.0 are exploitable in the default configuration. This issue was fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2.", "A flaw was found in LiteLLM. The proxy server reuses the same cryptographic key for encrypting stored data and generating session authentication tokens. An authenticated attacker can exploit this flaw by submitting crafted metadata to obtain an encrypted administrator credential, which can then be reused to forge an administrative session. Successful exploitation allows the attacker to achieve privilege escalation, gaining full administrative access and the ability to execute arbitrary commands on the underlying system."], "name": "CVE-2026-114612", "package_state": [{"cpe": "cpe:/a:redhat:exploit_intelligence:0", "fix_state": "Not affected", "package_name": "exploit-intelligence/vulnerability-analysis-rhel9", "product_name": "Exploit Intelligence"}, {"cpe": "cpe:/a:redhat:lightspeed_core", "fix_state": "Not affected", "package_name": "lightspeed-core/lightspeed-stack-rhel9", "product_name": "Lightspeed Core"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Not affected", "package_name": "ansible-automation-platform-26/lightspeed-chatbot-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Not affected", "package_name": "ansible-automation-platform-27/lightspeed-chatbot-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-llama-stack-core-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-mlflow-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-th-torch-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-th-torch-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-10-22T18:01:52Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-114612\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114612\nhttps://github.com/BerriAI/litellm/commit/1d5fdc87fed66b49e1df8cf7d708ad93249eb7d0\nhttps://github.com/BerriAI/litellm/commit/9161d7f9d6073603ba61ee4aa5e2c0ef5b37a81b\nhttps://github.com/BerriAI/litellm/commit/9fa1a641119dd0d4fe43e93622eae5f482ceb63f\nhttps://github.com/BerriAI/litellm/commit/a80eacacee118fbed54e3d98f239d17a63fac818\nhttps://github.com/BerriAI/litellm/commit/f7cd90f09e9716652b38daec9f0640cdf49d582b\nhttps://github.com/BerriAI/litellm/releases/tag/v1.100.4\nhttps://github.com/BerriAI/litellm/releases/tag/v1.101.3\nhttps://github.com/BerriAI/litellm/releases/tag/v1.102.2\nhttps://github.com/BerriAI/litellm/releases/tag/v1.103.1\nhttps://github.com/BerriAI/litellm/releases/tag/v1.104.0-rc.2\nhttps://github.com/BerriAI/litellm/security/advisories/GHSA-7hp6-4w63-5g45"], "threat_severity": "Critical"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.87.0,1.100.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.101.0,1.101.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.102.0,1.102.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.103.0,1.103.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.104.0-rc.1,1.104.0-rc.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "litellm", "source": "cna", "vendor": "BerriAI"}, "product": "litellm", "vendor": "berriai"}], "created": "2026-10-23T01:30:13.466908+00:00", "updated": "2026-10-24T02:00:16.886250+00:00", "vendors": ["berriai", "berriai$PRODUCT$litellm"]}