CVE-2026-114612

Summary

The LiteLLM proxy server reused a single cryptographic context for secrets and session tokens, enabling authenticated internal users to forge administrator credentials by crafting malicious metadata that, when replayed as a bearer token, granted full administrative access via the MCP stdio endpoint.

Exploitability

An authenticated internal user with low privileges can exploit this flaw without user interaction or complex conditions, requiring only knowledge of the vulnerable API flows.

Blast radius

Successful exploitation grants full administrative control over the proxy, enabling arbitrary command execution through the MCP stdio endpoint, potentially compromising all downstream LLM API calls and sensitive data processed by the system.

Detection

Look for API-key authentication requests returning encrypted metadata containing unexpected or malformed credential structures, and monitor for bearer tokens that decode to administrative privileges without corresponding high-privilege login events; no reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to LiteLLM version 1.100.4, 1.101.3, 1.102.2, 1.103.1, or 1.104.0-rc.2 (or later) immediately.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.