GHSA-7hp6-4w63-5g45 CVE-2026-114612
LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
- Severity
- 0.0 / 10
- Critical · CVSS 4.0
- Exploit chance (EPSS)
- 0.32%
- Chance of exploitation in the next 30 days. Higher than 24.91% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-269 Improper Privilege Management
- CWE-345 Insufficient Verification of Data Authenticity
- CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')
- Fix
1.100.4- Upgrade litellm to this version or later
Description
Summary
An authenticated user with internal_user privileges can escalate to proxy_admin and achieve remote code execution. The proxy uses one encryption key for two purposes: sealing secrets at rest and minting session tokens. An attacker exploits this by requesting a new API key with a crafted metadata field containing a forged admin credential as the "secret" value. The proxy encrypts and returns this payload. When this value is then presented as a bearer token, the proxy decrypts it, trusts the forged admin identity, and grants full administrative access, including the ability to execute arbitrary commands via the MCP stdio endpoint.
Affected versions
Versions later than 1.91.0 are exploitable in the default configuration. Versions 1.87.0 through 1.90.x are exploitable only if EXPERIMENTAL_UI_LOGIN=true was explicitly set.
Mitigation
Upgrade to a patched version as soon as possible.
If you cannot upgrade immediately, set EXPERIMENTAL_UI_LOGIN=false. This disables the vulnerable authentication path but also breaks CLI SSO and Claude Code gateway login.
Impact
An internal user can escalate to proxy admin and execute arbitrary commands on the host.
Discovery Credit: Hoa X. Nguyen (OPSWAT Unit 515)
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| litellm | >= 1.91.0, < 1.100.4 |
1.100.4 |
| litellm | >= 1.101.0, < 1.101.3 |
1.101.3 |
| litellm | >= 1.102.0, < 1.102.2 |
1.102.2 |
| litellm | >= 1.103.0, < 1.103.1 |
1.103.1 |
| litellm | >= 1.104.0rc1, < 1.104.0rc2 |
1.104.0rc2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
litellm PyPI → 1.100.4
- pip
pip install --upgrade "litellm>=1.100.4"- poetry
poetry add "litellm>=1.100.4"- uv
uv add "litellm>=1.100.4"
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- Low
- User interaction
- None
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 9.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it
- Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
- Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system.
- Architecture and Design: Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
CWE-345: Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')
The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.
How to prevent it
- Architecture and Design: Enforce the use of strong mutual authentication mechanism between the two parties.
- Architecture and Design: Whenever a product is an intermediary or proxy for transactions between two other components, the proxy core should not drop the identity of the initiator of the transaction. The immutability of the identity of the initiator must be maintained and should be forwarded all the way to the target.
References
Advisories
Packages
Other links
- github.com/BerriAI/litellm/security/advisories/GHSA-7hp6-4w63-5g45
- github.com/BerriAI/litellm/commit/1d5fdc87fed66b49e1df8cf7d708ad93249eb7d0
- github.com/BerriAI/litellm/commit/9161d7f9d6073603ba61ee4aa5e2c0ef5b37a81b
- github.com/BerriAI/litellm/commit/9fa1a641119dd0d4fe43e93622eae5f482ceb63f
- github.com/BerriAI/litellm/commit/a80eacacee118fbed54e3d98f239d17a63fac818
- github.com/BerriAI/litellm/commit/f7cd90f09e9716652b38daec9f0640cdf49d582b
- github.com/BerriAI/litellm/releases/tag/v1.100.4
- github.com/BerriAI/litellm/releases/tag/v1.101.3
- github.com/BerriAI/litellm/releases/tag/v1.102.2
- github.com/BerriAI/litellm/releases/tag/v1.103.1
- github.com/BerriAI/litellm/releases/tag/v1.104.0-rc.2
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-7488-6r32-c95q LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback | High Known exploited | Also affects litellm |
| GHSA-v4p8-mg3p-g94g LiteLLM: Authenticated command execution via MCP stdio test endpoints | High Known exploited | Also affects litellm |
| GHSA-r75f-5x8p-qvmc LiteLLM has SQL Injection in Proxy API key verification | Critical Known exploited | Also affects litellm |
| GHSA-g5ff-637f-6q2m LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials` | High | Also affects litellm |
| GHSA-hhww-mrg2-969h LiteLLM vulnerable to reflected XSS in /sso/debug/callback | Medium | Also affects litellm |
| GHSA-hx8v-g79f-8w5f LiteLLM Proxy has server-side request forgery via the `user_config` request parameter | Medium | Also affects litellm |
| GHSA-3cv6-jpf6-8222 LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters | Medium | Also affects litellm |
| GHSA-6wvf-77m9-58rm LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint | Critical | Also affects litellm |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor