LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
LiteLLM
More for LiteLLM RSS feed for LiteLLM
- Severity
- Critical, CVSS 9.9
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Record
- CVE-2026-114612
- Affects
- LiteLLM
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- October 27, 2026
- Source last modified
- October 27, 2026
Description
Summary
An authenticated user with internal_user privileges can escalate to proxy_admin and achieve remote code execution. The proxy uses one encryption key for two purposes: sealing secrets at rest and minting session tokens. An attacker exploits this by requesting a new API key with a crafted metadata field containing a forged admin credential as the "secret" value. The proxy encrypts and returns this payload. When this value is then presented as a bearer token, the proxy decrypts it, trusts the forged admin identity, and grants full administrative access, including the ability to execute arbitrary commands via the MCP stdio endpoint.
Affected versions
Versions later than 1.91.0 are exploitable in the default configuration. Versions 1.87.0 through 1.90.x are exploitable only if EXPERIMENTAL_UI_LOGIN=true was explicitly set.
Mitigation
Upgrade to a patched version as soon as possible.
If you cannot upgrade immediately, set EXPERIMENTAL_UI_LOGIN=false. This disables the vulnerable authentication path but also breaks CLI SSO and Claude Code gateway login.
Impact
An internal user can escalate to proxy admin and execute arbitrary commands on the host.
Discovery Credit: Hoa X. Nguyen (OPSWAT Unit 515)
Description quoted from the NVD record.
Who is affected
Your organization is affected if it runs LiteLLM, made by BerriAI, a gateway that sits between your staff or apps and AI language model services. Versions later than 1.91.0 are affected in their standard setup. Versions 1.87.0 through 1.90.x are affected only if someone turned on the EXPERIMENTAL_UI_LOGIN=true setting. Someone with an ordinary user account on LiteLLM could trick its login system into treating them as a full administrator, then run any commands they like on the computer that hosts it. This flaw is rated Critical.
What to do
- The person who installed or runs LiteLLM for your organization should act on this. If an IT provider or vendor runs it for you, send them this advisory and ask when the update will be done.
- No fixed version is named for this flaw yet, so check the vendor advisory linked on this page for a fixed release and upgrade to it as soon as possible.
- If you cannot upgrade right away, set
EXPERIMENTAL_UI_LOGIN=false. This turns off the vulnerable login path. - Be aware that this setting also breaks single sign-on from the command-line tool and Claude Code gateway login, so warn anyone who relies on them before making the change.
Analysis written from the source record as of October 27, 2026 and reviewed before publishing.