CVE-2026-114612Critical· 9.9▾ AbyssalPoC availableLiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 54.5 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Oct 24.
Disclosure to exploitation, from the record and what we observed since indexing it.
0.2%
9.9 → 8.8
critical → high
1 GitHub repo
0.2% → 0.3%
Disclosed via OSV
8.8 → 9.9
high → critical
An authenticated user with internal_user privileges can escalate to proxy_admin and achieve remote code execution. The proxy uses one encryption key for two purposes: sealing secrets at rest and minting session tokens. An attacker exploits this by requesting a new API key with a crafted metadata field containing a forged admin credential as the "secret" value. The proxy encrypts and returns this payload. When this value is then presented as a bearer token, the proxy decrypts it, trusts the forged admin identity, and grants full administrative access, including the ability to execute arbitrary commands via the MCP stdio endpoint.
Versions later than 1.91.0 are exploitable in the default configuration. Versions 1.87.0 through 1.90.x are exploitable only if EXPERIMENTAL_UI_LOGIN=true was explicitly set.
Upgrade to a patched version as soon as possible.
If you cannot upgrade immediately, set EXPERIMENTAL_UI_LOGIN=false. This disables the vulnerable authentication path but also breaks CLI SSO and Claude Code gateway login.
An internal user can escalate to proxy admin and execute arbitrary commands on the host.
Discovery Credit: Hoa X. Nguyen (OPSWAT Unit 515)
litellm >= 1.91.0, < 1.100.4litellm >= 1.101.0, < 1.101.3litellm >= 1.102.0, < 1.102.2litellm >= 1.103.0, < 1.103.1litellm >= 1.104.0rc1, < 1.104.0rc2Upgrade to a patched release:
litellm 1.100.4litellm 1.101.3litellm 1.102.2litellm 1.103.1litellm 1.104.0rc2Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-93355High· 8.1LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentic…
CVE-2026-12795High· 7.3litellm: BerriAI litellm: Missing authentication in SSO Debug Flow allows remote access. (CVE-2026-12795)
CVE-2026-49468Critical· 9.8LiteLLM: Authentication Bypass via Host Header Injection
CVE-2026-47102High· 8.8LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint
CVE-2026-47101High· 8.8LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit
CVE-2026-108574Medium· 4.3A flaw has been found in BerriAI LiteLLM up to 1.95.0