{"id":"CVE-2026-114612","aliases":["GHSA-7hp6-4w63-5g45"],"title":"LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key","summary":"LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key","severity":"critical","cvss":9.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","vendor":"litellm","product":"litellm","ecosystem":"pip","affected":["litellm >= 1.91.0, < 1.100.4","litellm >= 1.101.0, < 1.101.3","litellm >= 1.102.0, < 1.102.2","litellm >= 1.103.0, < 1.103.1","litellm >= 1.104.0rc1, < 1.104.0rc2"],"patched":["litellm 1.100.4","litellm 1.101.3","litellm 1.102.2","litellm 1.103.1","litellm 1.104.0rc2"],"published":"2026-10-27","updated":"2026-10-27","sourceUpdated":"2026-10-27T15:15:08.260681544Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-7hp6-4w63-5g45","references":[{"url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-7hp6-4w63-5g45"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114612"},{"url":"https://github.com/BerriAI/litellm/commit/1d5fdc87fed66b49e1df8cf7d708ad93249eb7d0"},{"url":"https://github.com/BerriAI/litellm/commit/9161d7f9d6073603ba61ee4aa5e2c0ef5b37a81b"},{"url":"https://github.com/BerriAI/litellm/commit/9fa1a641119dd0d4fe43e93622eae5f482ceb63f"},{"url":"https://github.com/BerriAI/litellm/commit/a80eacacee118fbed54e3d98f239d17a63fac818"},{"url":"https://github.com/BerriAI/litellm/commit/f7cd90f09e9716652b38daec9f0640cdf49d582b"},{"url":"https://github.com/BerriAI/litellm"},{"url":"https://github.com/BerriAI/litellm/releases/tag/v1.100.4"},{"url":"https://github.com/BerriAI/litellm/releases/tag/v1.101.3"},{"url":"https://github.com/BerriAI/litellm/releases/tag/v1.102.2"},{"url":"https://github.com/BerriAI/litellm/releases/tag/v1.103.1"},{"url":"https://github.com/BerriAI/litellm/releases/tag/v1.104.0-rc.2"},{"url":"https://github.com/advisories/GHSA-7hp6-4w63-5g45"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114612.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-114612"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559212"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-114612"}],"tags":["osv","pip","exploit-available","ghsa","csaf","vex","red-hat","cve.org"],"epss":0.00319,"epssPercentile":0.24722,"exploits":{"github":1,"githubRepos":["https://github.com/Hunt-Benito/one-salt-to-forge-them-all-cve-2026-114612-forged-admin-session-in-litellm"],"checkedAt":"2026-10-27T16:20:47.576Z"},"exploitAvailable":true,"cwe":["CWE-269","CWE-345","CWE-441","CWE-290"],"scores":{"osv":9.9,"ghsa":9.9,"vendor":8.8,"cna":9.9},"ingestedAt":"2026-10-22T22:00:50.361Z","slug":"CVE-2026-114612","body":"## Overview\n\n### Summary\n\nAn authenticated user with `internal_user` privileges can escalate to `proxy_admin` and achieve remote code execution. The proxy uses one encryption key for two purposes: sealing secrets at rest and minting session tokens. An attacker exploits this by requesting a new API key with a crafted metadata field containing a forged admin credential as the \"secret\" value. The proxy encrypts and returns this payload. When this value is then presented as a bearer token, the proxy decrypts it, trusts the forged admin identity, and grants full administrative access, including the ability to execute arbitrary commands via the MCP stdio endpoint.\n\n### Affected versions\n\nVersions later than 1.91.0 are exploitable in the default configuration. Versions 1.87.0 through 1.90.x are exploitable only if `EXPERIMENTAL_UI_LOGIN=true` was explicitly set.\n\n### Mitigation\n\nUpgrade to a patched version as soon as possible.\n\nIf you cannot upgrade immediately, set `EXPERIMENTAL_UI_LOGIN=false`. This disables the vulnerable authentication path but also breaks CLI SSO and Claude Code gateway login.\n\n### Impact\n\nAn internal user can escalate to proxy admin and execute arbitrary commands on the host.\n\n**Discovery Credit:** Hoa X. Nguyen (OPSWAT Unit 515)\n\n## Affected packages\n\n- `litellm >= 1.91.0, < 1.100.4`\n- `litellm >= 1.101.0, < 1.101.3`\n- `litellm >= 1.102.0, < 1.102.2`\n- `litellm >= 1.103.0, < 1.103.1`\n- `litellm >= 1.104.0rc1, < 1.104.0rc2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `litellm 1.100.4`\n- `litellm 1.101.3`\n- `litellm 1.102.2`\n- `litellm 1.103.1`\n- `litellm 1.104.0rc2`\n\n## Vendor advisories\n\n- **Red Hat VEX** · Critical · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114612.json)","depth":"abyssal","depthScore":67,"depthScoreParts":{"impact":54.5,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":229910,"id":"CVE-2026-114612","ts":1793118049858,"field":"severity","old":"high","new":"critical"},{"seq":229842,"id":"CVE-2026-114612","ts":1793117559195,"field":"cvss","old":"8.8","new":"9.9"},{"seq":229094,"id":"CVE-2026-114612","ts":1792904673325,"field":"exploit_available","old":"false","new":"true"},{"seq":228677,"id":"CVE-2026-114612","ts":1792844899858,"field":"cvss","old":"9.9","new":"8.8"},{"seq":228676,"id":"CVE-2026-114612","ts":1792844899858,"field":"severity","old":"critical","new":"high"}]}