CVE-2026-114612: CVE-2026-114612: Privilege Escalation to Proxy Admin via Cryptographic Context Reuse in LiteLLM

A critical cryptographic domain-separation flaw, tracked as CVE-2026-114612 with a CVSS score of 9.9, affects LiteLLM proxy versions 1.87.0 through 1.104.0-rc.1, allowing an authenticated low-privilege user to escalate to full proxy administrator and achieve remote command execution via the MCP stdio interface. The vulnerability stems from reusing a single AES-256-GCM encryption context without Associated Authenticated Data for both at-rest secret encryption and session bearer tokens, letting attackers use the API-key generation flow as an encryption oracle and replay the resulting ciphertext as a bearer token. Patched releases are available in 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, with mitigations including blocking Authorization headers containing 'v2:gcm:' or 'litellm_enc::' prefixes and restricting MCP stdio transport in production.

CVE-2026-114612: Privilege Escalation to Proxy Admin via Cryptographic Context Reuse in LiteLLM Vulnerability ID: CVE-2026-114612 CVSS Score: 9.9 Published: 2026-10-22 LiteLLM versions 1.87.0 through 1.104.0-rc.1 contain a cryptographic domain separation vulnerability CWE-269, CWE-345, CWE-441 that allows an authenticated low-privilege user to escalate privileges to full proxy administrator. The application reuses a single symmetric cryptographic context and key derivation path for both at-rest secret encryption and ephemeral UI/CLI session authentication tokens without providing Associated Authenticated Data AAD . By submitting crafted JSON session claims into user-accessible encrypted metadata fields, an attacker can use the API-key generation flow as an encryption oracle, extract the resulting ciphertext, and replay it as a bearer token to achieve administrative control and subsequent remote command execution via the Model Context Protocol MCP stdio interface. TL;DR LiteLLM reuses the same AES-256-GCM encryption context without domain separation for both stored metadata secrets and administrative session bearer tokens. Authenticated internal users can store forged administrator JSON payloads inside API key metadata, retrieve the encrypted string, and replay it as an HTTP Bearer token to gain full proxy admin privileges and remote command execution. ⚠️ Exploit Status: POC Technical Details - CWE ID : CWE-269 / CWE-345 / CWE-441 - Attack Vector : Network Authenticated Low-Privilege API - CVSS v3.1 Score : 9.9 Critical - EPSS Score : 0.24% 13.63th Percentile - Primary Impact : Privilege Escalation to proxy admin & RCE via MCP stdio - Exploit Status : Proof-of-Concept Official E2E Regression Test - CISA KEV Status : Not Listed Affected Systems - BerriAI LiteLLM Proxy Server - Chainguard LiteLLM Container Images - litellm : = 1.87.0, < 1.100.4 Fixed in: 1.100.4 - litellm : = 1.101.0, < 1.101.3 Fixed in: 1.101.3 - litellm : = 1.102.0, < 1.102.2 Fixed in: 1.102.2 - litellm : = 1.103.0, < 1.103.1 Fixed in: 1.103.1 - litellm : = 1.104.0-rc.1, < 1.104.0-rc.2 Fixed in: 1.104.0-rc.2 Code Analysis Enforce cryptographic domain separation for session bearer tokens via AES-256-GCM AAD and litellm login prefix Backport session bearer token domain separation fix to maintenance branch Backport session bearer token domain separation fix to maintenance branch Backport session bearer token domain separation fix to maintenance branch Backport session bearer token domain separation fix to maintenance branch Exploit Details - GitHub Official E2E Regression Suite https://github.com/BerriAI/litellm/commit/1d5fdc87fed66b49e1df8cf7d708ad93249eb7d0 : End-to-end regression test tests/e2e/other/test session token e2e.py demonstrating the oracle encryption via /key/generate langfuse secret key and replay against /user/list. Mitigation Strategies - Upgrade LiteLLM Proxy to the latest patched maintenance release for your deployment branch 1.100.4, 1.101.3, 1.102.2, 1.103.1, or 1.104.0-rc.2+ . - Deploy WAF or reverse-proxy inspection rules to block HTTP Authorization headers containing 'v2:gcm:' or 'litellm enc::' prefixes. - Restrict or disable Model Context Protocol MCP stdio transport capabilities in production environments to prevent administrative privilege escalation from translating into host command execution. - Disable EXPERIMENTAL UI LOGIN if operating legacy LiteLLM versions between 1.87.0 and 1.90.x. Remediation Steps: 1. Identify all deployed LiteLLM proxy instances and container images across staging and production clusters. 2. Update the litellm Python package or container image tag to = 1.100.4 for 1.100.x , = 1.101.3 for 1.101.x , = 1.102.2 for 1.102.x , = 1.103.1 for 1.103.x , or = 1.104.0-rc.2. 3. Audit the LiteLLM database specifically the LiteLLM VerificationToken table for API keys containing suspicious JSON strings inside metadata.logging .callback vars. 4. Rotate the proxy MASTER KEY and LITELLM SALT KEY if untrusted users had internal user access while running an unpatched version. References Read the full report for CVE-2026-114612 on our website https://cvereports.com/reports/CVE-2026-114612 for more details including interactive diagrams and full exploit analysis.