LiteLLM: Privilege escalation to proxy admin

Summary

LiteLLM is an open-source proxy (AI gateway) for calling LLM APIs. Because the proxy uses one cryptographic context for both at-rest secrets and session tokens, an authenticated internal user can get a forged proxy administrator credential encrypted and returned by the API-key flow. Replaying this ciphertext as a bearer token makes the proxy trust the forged administrator identity, which allows administrative access and, through the MCP stdio endpoint, arbitrary commands. The CVSS score is 9.9 (Critical), and the attacker needs only a valid internal_user account.

Affected

• BerriAI LiteLLM >= 1.87.0, < 1.100.4
• BerriAI LiteLLM >= 1.101.0, < 1.101.3
• BerriAI LiteLLM >= 1.102.0, < 1.102.2
• BerriAI LiteLLM >= 1.103.0, < 1.103.1
• BerriAI LiteLLM >= 1.104.0-rc.1, < 1.104.0-rc.2
• Discrepancy: the vendor advisory lists the range starting at 1.91.0, while the CVE description starts at 1.87.0. Per the description, 1.87.0 to 1.90.x is only affected when EXPERIMENTAL_UI_LOGIN is enabled. Treat 1.87.0 to 1.90.x as potentially affected until the vendor clarifies.
• Unknown: whether branches older than 1.100 are affected or patched.

Fixed in

• 1.100.4
• 1.101.3
• 1.102.2
• 1.103.1
• 1.104.0-rc.2 (release candidate)

Workaround

Unknown. The vendor has not published a workaround.

• Disabling unnecessary MCP stdio tools limits command execution only. It does not fix the privilege escalation.

Exploitation

• Public proof-of-concept code exists on GitHub.
• No confirmed active exploitation in the wild was found. CISA KEV was not checked.

Our recommendation

• Update LiteLLM to a fixed version (1.100.4, 1.101.3, 1.102.2, 1.103.1 or 1.104.0-rc.2 or later) as soon as possible.
• Check whether the proxy is reachable from the internet and restrict access to trusted networks.
• Check whether MCP stdio is enabled and disable it if it is not needed.
• Review internal_user accounts and the proxy's admin activity for signs of misuse.
• Confirm the installed version before relying on upgrade guidance from third parties.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  Hunt-Benito/one-salt-to-forge-them-all-cve-2026-114612-forged-admin-session-in-litellm

Research sources

• GitHub Security Advisory GHSA-7hp6-4w63-5g45 github.com
• Fix commit 1d5fdc87 (session token AES-GCM context) github.com
• LiteLLM release v1.100.4 github.com
• LiteLLM release v1.101.3 github.com
• LiteLLM release v1.102.2 github.com
• LiteLLM release v1.103.1 github.com
• Third-party analysis (dev.to cverports) dev.to

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:57.