LiteLLM Proxy Session Flaw CVSS 9.9 Lets Auth Users Forge Admin Credentials

LiteLLM proxy server versions up to 1.104.0-rc.2 contain a critical vulnerability that allows authenticated users to escalate privileges to administrator level. The flaw stems from reusing a single cryptographic context for both at-rest secrets and session tokens, enabling the creation of valid but forged administrative bearer tokens.

What happened

LiteLLM is a proxy server acting as an AI gateway for calling large language model APIs in OpenAI or native formats. The National Vulnerability Database records CVE-2026-114612 with a CVSS score of 9.9, classifying it as critical. The weakness involves improper privilege management and cryptographic issues, specifically CWE-269, CWE-345, and CWE-441.

From version 1.87.0 until the release of 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens. An authenticated internal user can craft metadata containing a forged administrator credential. This credential is encrypted and returned by the API-key flow mechanism within the proxy.

Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity. This trust permits administrative access and allows arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require the EXPERIMENTAL_UI_LOGIN setting to be enabled for exploitation. Versions after 1.91.0 are exploitable in the default configuration without additional changes.

Why it matters

This issue affects BerriAI litellm versions starting from 1.87.0 up to, but not including, the specific patched versions listed above. The vulnerability was fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2. Environments running any version within these ranges remain exposed to privilege escalation attacks.

As Firewall Chronicle reported on 2026-10-14 regarding Microsoft SQL Server, high-severity flaws often allow authorized users to elevate privileges. Similarly, the SiteGuard WAF command injection detailed on 2026-10-19 enabled local privilege escalation to root. These incidents highlight the persistent risk of internal users gaining excessive control through software flaws.

What to watch

• Monitor for unexpected administrative actions originating from standard user accounts within the LiteLLM proxy.
• Check logs for unusual bearer token patterns or repeated authentication failures that might indicate token forgery attempts.
• Review access logs for the MCP stdio endpoint for command execution that does not match expected operational workflows.

Signals worth monitoring

Security operations teams should look for authentication events where lower-privilege users attempt to access administrative endpoints. Check whether session tokens are being generated or validated in ways that deviate from standard patterns. Look for spikes in API-key flow requests that result in successful administrative access. First containment moves typically involve isolating affected proxy instances and revoking compromised tokens. Teams usually enable enhanced logging on authentication modules to capture detailed metadata about token validation failures and successes.

Background: CVSS score

CVSS provides a standardized vector for exploit difficulty and access requirements, not business value. A high score indicates an easy attack path, not necessarily significant damage. You must contextualize the score with your environment’s exposure, asset value, and compensating controls to determine true risk.

Read the full guide: CVSS Scores: Why High Numbers Mislead Your Risk Assessment

What to do and how to stay safe: LiteLLM

• Audit all LiteLLM proxy installations to verify they are running versions 1.100.4, 1.101.3, 1.102.2, 1.103.1, or 1.104.0-rc.2 or later.
• Review internal user permissions to ensure only necessary accounts have authenticated access to the proxy API-key flow.
• Inspect logs for any instances of the EXPERIMENTAL_UI_LOGIN feature being enabled on systems running versions prior to 1.91.0.
• Monitor the MCP stdio endpoint for any command execution that originates from non-administrative user sessions.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which LiteLLM versions are affected by CVE-2026-114612?

Versions from 1.87.0 up to, but not including, 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2 are affected.

Is this vulnerability exploitable by default in recent versions?

Yes, versions after 1.91.0 are exploitable in the default configuration, whereas earlier versions require EXPERIMENTAL_UI_LOGIN to be enabled.

What is the impact of successfully exploiting this flaw?

An attacker can gain administrative access and execute arbitrary commands through the MCP stdio endpoint by forging an administrator credential.