Vulnpedia
← Search CVEs

CVE-2026-114612

CRITICAL 9.9

Published 2026-10-22 · Last modified 2026-10-22

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow. Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require EXPERIMENTAL_UI_LOGIN to be enabled, while versions after 1.91.0 are exploitable in the default configuration. This issue was fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2.

ELEVATED IMPACT

Severe if exploited (CVSS 9.9), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.3%chance of exploitation in 30 days · 25th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

9.9CVSS 3.1 · CRITICAL

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ⚠Privileges: Requires a low-privilege account
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Berriai

Products Litellm

Weakness (CWE)

  • CWE-269: : Improper Privilege Management
  • CWE-345: : Insufficient Verification of Data Authenticity
  • CWE-441: : Unintended Proxy or Intermediary ('Confused Deputy')

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References and research data (JSON)

Vendor product assessments

  • exploit-intelligence/vulnerability-analysis-rhel9 as a component of Exploit Intelligence · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/vulnerability-analysis-rhel9?repository_url=registry.redhat.io/exploit-intelligence/vulnerability-analysis-rhel9

    Red Hat · CVE-2026-114612 · Updated 2026-10-23T17:38:58+00:00
  • lightspeed-core/lightspeed-stack-rhel9 as a component of Lightspeed Core · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/lightspeed-stack-rhel9?repository_url=registry.redhat.io/lightspeed-core/lightspeed-stack-rhel9

    Red Hat · CVE-2026-114612 · Updated 2026-10-23T17:38:58+00:00
  • ansible-automation-platform-26/lightspeed-chatbot-rhel9 as a component of Red Hat Ansible Automation Platform 2 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/lightspeed-chatbot-rhel9?repository_url=registry.redhat.io/ansible-automation-platform-26/lightspeed-chatbot-rhel9

    Red Hat · CVE-2026-114612 · Updated 2026-10-23T17:38:58+00:00
  • ansible-automation-platform-27/lightspeed-chatbot-rhel9 as a component of Red Hat Ansible Automation Platform 2 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/lightspeed-chatbot-rhel9?repository_url=registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9

    Red Hat · CVE-2026-114612 · Updated 2026-10-23T17:38:58+00:00
  • rhoai/odh-llama-stack-core-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-llama-stack-core-rhel9?repository_url=registry.redhat.io/rhoai/odh-llama-stack-core-rhel9

    Red Hat · CVE-2026-114612 · Updated 2026-10-23T17:38:58+00:00
  • rhoai/odh-mlflow-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-mlflow-rhel9?repository_url=registry.redhat.io/rhoai/odh-mlflow-rhel9

    Red Hat · CVE-2026-114612 · Updated 2026-10-23T17:38:58+00:00
  • rhoai/odh-th-torch-cpu-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-th-torch-cpu-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-th-torch-cpu-py312-rhel9

    Red Hat · CVE-2026-114612 · Updated 2026-10-23T17:38:58+00:00
  • rhoai/odh-th-torch-cuda-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-th-torch-cuda-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-th-torch-cuda-py312-rhel9

    Red Hat · CVE-2026-114612 · Updated 2026-10-23T17:38:58+00:00
  • rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-trustyai-garak-lls-provider-dsp-rhel9?repository_url=registry.redhat.io/rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9

    Red Hat · CVE-2026-114612 · Updated 2026-10-23T17:38:58+00:00

Unverified PoC candidates

Catalogue matches for further research. These repositories have not been validated as working exploits.

1 candidate

All CVSS metrics

  • CRITICAL 9.9 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
  • CRITICAL 9.9 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS