# CVE-2026-114612: LiteLLM proxy authentication bypass via reused crypto context

Source: https://junglewise.ai/threats/cve-2026-114612-litellm-is-a-proxy-server-ai-gateway-to-call-llm-apis-in-openai  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-114612 · Severity: critical · CVSS 9.9 · Published 2026-10-22

LiteLLM is a proxy server that routes requests to language model APIs in a standardized format. The proxy reuses the same encryption key for both at-rest secrets and session tokens, allowing an authenticated user to forge administrator credentials that the proxy will trust. An attacker with internal access can gain admin rights and execute arbitrary commands on the system.

Technologies: [Berriai LiteLLM](https://junglewise.ai/threats/technologies/litellm), [litellm (PyPI)](https://junglewise.ai/threats/technologies/pypi-litellm). Vendors: [Berriai](https://junglewise.ai/threats/vendors/berriai), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-114612 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114612 being exploited in the wild.

**How severe is CVE-2026-114612?** Critical severity, with a CVSS score of 9.9, published 22 October 2026.

**Which products and versions are affected?** Berriai LiteLLM 1.87.0 to 1.100.3, 1.101.2, 1.102.1, 1.103.0; litellm (PyPI) >= 1.91.0, < 1.100.4, ECOSYSTEM:introduced=1.91.0,fixed=1.100.4.

**Is there a fix for CVE-2026-114612?** Yes. litellm (PyPI): upgrade to 1.100.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114612 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-114612?** Check whether you run Berriai LiteLLM or litellm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- litellm (PyPI): upgrade to 1.100.4 or later

  ```sh
  pip install "litellm>=1.100.4"
  ```


## Technical details

The vulnerability exists in the cryptographic context handling for authentication tokens. Versions 1.87.0 through 1.100.3, 1.101.2, 1.102.1, and 1.103.0 reuse a single AES-GCM encryption context for both API-key flow secrets and UI/CLI session tokens, allowing an authenticated internal user to craft a forged administrator credential, encrypt it using the secret flow, and replay the ciphertext as a bearer token to gain unauthorized administrative access to the MCP stdio endpoint. The issue affects default configurations in versions 1.91.0 and later.

## Affected products

- BerriAI LiteLLM 1.87.0 to 1.100.3, 1.101.2, 1.102.1, 1.103.0

## Identifiers

- CVE-2026-114612
- GHSA-7hp6-4w63-5g45

## Timeline

- 2026-10-22: disclosed

## References

- [https://github.com/BerriAI/litellm/commit/1d5fdc87fed66b49e1df8cf7d708ad93249eb7d0](https://github.com/BerriAI/litellm/commit/1d5fdc87fed66b49e1df8cf7d708ad93249eb7d0)
- [https://github.com/BerriAI/litellm/commit/9161d7f9d6073603ba61ee4aa5e2c0ef5b37a81b](https://github.com/BerriAI/litellm/commit/9161d7f9d6073603ba61ee4aa5e2c0ef5b37a81b)

## Related threats

- [LiteLLM arbitrary local file read via vertex_ai_credentials](https://junglewise.ai/threats/litellm-internal-user-viewer-arbitrary-local-file-read-via-vertex-ai-649a7475)
- [LiteLLM reflected XSS in SSO debug callback endpoint](https://junglewise.ai/threats/litellm-vulnerable-to-reflected-xss-in-sso-debug-callback-38154651)
- [BerriAI LiteLLM improper authorization in secret resolution](https://junglewise.ai/threats/cve-2026-108575-a-vulnerability-has-been-found-in-berriai-litellm-up-to-1-94-0)
- [BerriAI LiteLLM authorization bypass in spend tracking](https://junglewise.ai/threats/cve-2026-108574-a-flaw-has-been-found-in-berriai-litellm-up-to-1-95-0-affected)
- [BerriAI LiteLLM tenant isolation bypass in semantic cache](https://junglewise.ai/threats/cve-2026-89032-berriai-litellm-before-1-101-0-rc-1-contains-a-tenant-isolation)