Recommended action window: Monitor and triage in normal cycle
NVD description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow. Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require EXPERIMENTAL_UI_LOGIN to be enabled, while versions after 1.91.0 are exploitable in the default configuration. This issue was fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
LiteLLM CVE-2026-114612: CVSS 9.9 privilege escalation to proxy admin. A shared salt key lets an authenticated internal user forge an admin credential and reach command execution through the MCP stdio endpoint. Exposed by default from 1.91.0. Fixed in 1.100.4, 1.101.3, 1.102.2 and 1.103.1. VulnTracker recommends upgrading your LiteLLM proxy now. Details: http://vulntracker.io/cves/CVE-2026-114612 #LiteLLM #AI #CVE #InfoSec
🚨Critical - LiteLLM Proxy Admin Impersonation via Crypto Context Reuse (CVE-2026-114612) LiteLLM proxy reuses a single cryptographic context for at-rest secrets and session tokens, letting an authenticated internal user obtain a forged admin credential via the API-key flow. Replay the returned ciphertext as a bearer token to impersonate a proxy admin and reach RCE via the MCP stdio endpoint. v1.87.0-1.90.x requires EXPERIMENTAL_UI_LOGIN enabled. 👉Affected: litellm 1.87.0-1.104.0-rc.1 | Upgrade to 1.104.0-rc.2 (or 1.103.1/1.102.2/1.101.3/1.100.4)
If you run the LiteLLM proxy for your team's AI keys, patch today. CVE-2026-114612 (CVSS 9.9): any user with internal_user rights can forge an admin token, then run commands on the host through the MCP stdio endpoint. From 1.91.0 on it works in the default config. Fix: upgrade to 1.100.4 / 1.101.3 / 1.102.2 / 1.103.1 or later. Check: pip show litellm | grep -i version https://vibevulns.com/issues/cve-2026-114612-litellm-salt-key-reuse-admin-escalation-rce/
🚨 CRITICAL — CVE-2026-114612 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.… CVSS 9.9 🔴 No patch yet Full analysis → https://sec.kaitan.id/cves/CVE-2026-114612 #OpenAI #CyberSecurity #InfoSec