#

CVE-2026-114612: Privilege Escalation to Proxy Admin via Cryptographic Context Reuse in LiteLLM

Vulnerability ID: CVE-2026-114612 CVSS Score: 9.9

Published: 2026-10-22 LiteLLM versions 1.87.0 through 1.104.0-rc.1 contain a cryptographic domain separation vulnerability (CWE-269, CWE-345, CWE-441) that allows an authenticated low-privilege user to escalate privileges to full proxy administrator. The application reuses a single symmetric cryptographic context and key derivation path for both at-rest secret encryption and ephemeral UI/CLI session authentication tokens without providing Associated Authenticated Data (AAD). By submitting crafted JSON session claims into user-accessible encrypted metadata fields, an attacker can use the API-key generation flow as an encryption oracle, extract the resulting ciphertext, and replay it as a bearer token to achieve administrative control and subsequent remote command execution via the Model Context Protocol (MCP) stdio interface.

#

TL;DR

LiteLLM reuses the same AES-256-GCM encryption context without domain separation for both stored metadata secrets and administrative session bearer tokens. Authenticated internal users can store forged administrator JSON payloads inside API key metadata, retrieve the encrypted string, and replay it as an HTTP Bearer token to gain full proxy_admin privileges and remote command execution.

⚠️ Exploit Status: POC

#

Technical Details

CWE ID : CWE-269 / CWE-345 / CWE-441 #

Attack Vector : Network (Authenticated Low-Privilege API) #

CVSS v3.1 Score : 9.9 (Critical) #

EPSS Score : 0.24% (13.63th Percentile) #

Primary Impact : Privilege Escalation to proxy_admin & RCE via MCP stdio #

Exploit Status : Proof-of-Concept (Official E2E Regression Test) #

CISA KEV Status : Not Listed

#

Affected Systems

• BerriAI LiteLLM Proxy Server
• Chainguard LiteLLM Container Images

litellm : >= 1.87.0, < 1.100.4 (Fixed in:1.100.4 ) #

litellm : >= 1.101.0, < 1.101.3 (Fixed in:1.101.3 ) #

litellm : >= 1.102.0, < 1.102.2 (Fixed in:1.102.2 ) #

litellm : >= 1.103.0, < 1.103.1 (Fixed in:1.103.1 ) #

litellm : >= 1.104.0-rc.1, < 1.104.0-rc.2 (Fixed in:1.104.0-rc.2 )

#

Code Analysis

Enforce cryptographic domain separation for session bearer tokens via AES-256-GCM AAD and litellm_login_ prefix

Backport session bearer token domain separation fix to maintenance branch

Backport session bearer token domain separation fix to maintenance branch

Backport session bearer token domain separation fix to maintenance branch

Backport session bearer token domain separation fix to maintenance branch

#

Exploit Details

GitHub (Official E2E Regression Suite) : End-to-end regression test (tests/e2e/other/test_session_token_e2e.py) demonstrating the oracle encryption via /key/generate langfuse_secret_key and replay against /user/list.

#

Mitigation Strategies

• Upgrade LiteLLM Proxy to the latest patched maintenance release for your deployment branch (1.100.4, 1.101.3, 1.102.2, 1.103.1, or 1.104.0-rc.2+).
• Deploy WAF or reverse-proxy inspection rules to block HTTP Authorization headers containing 'v2:gcm:' or 'litellm_enc::' prefixes.
• Restrict or disable Model Context Protocol (MCP) stdio transport capabilities in production environments to prevent administrative privilege escalation from translating into host command execution.
• Disable EXPERIMENTAL_UI_LOGIN if operating legacy LiteLLM versions between 1.87.0 and 1.90.x.

Remediation Steps:

1. Identify all deployed LiteLLM proxy instances and container images across staging and production clusters.
2. Update the litellm Python package or container image tag to >= 1.100.4 (for 1.100.x), >= 1.101.3 (for 1.101.x), >= 1.102.2 (for 1.102.x), >= 1.103.1 (for 1.103.x), or >= 1.104.0-rc.2.
3. Audit the LiteLLM database (specifically the LiteLLM_VerificationToken table) for API keys containing suspicious JSON strings inside metadata.logging[].callback_vars.
4. Rotate the proxy MASTER_KEY and LITELLM_SALT_KEY if untrusted users had internal_user access while running an unpatched version.

#

References

Read the full report for CVE-2026-114612 on our website for more details including interactive diagrams and full exploit analysis.

source & further reading

dev.to — original article Momentloom: Let the right video find you Siesta: the anti-todo list that runs Gemma 3 1B in your browser and tells you to do less The First Thing I Set Up Before Any AI Coding Agent