LiteLLM Proxy at a glance
On October 27, 2026, BerriAI disclosed that a LiteLLM proxy user with the basic internal_user role could forge an admin session and run commands on the host through the MCP stdio endpoint. A second advisory covers a file read that can leak the master key. Fixed releases shipped September 30.
LiteLLM Proxy: status
- Affected
- LiteLLM proxy 1.91.0 up to the fixed builds 1.100.4, 1.101.3, 1.102.2, 1.103.1 and 1.104.0rc2 (privilege escalation to proxy_admin, CVE-2026-114612); 1.87.0 to 1.90.x only with EXPERIMENTAL_UI_LOGIN=true
- LiteLLM proxy before 1.95.0 (arbitrary local file read through vertex_ai_credentials, GHSA-g5ff-637f-6q2m)
- CVE identifiers
- Status as of
- Discovered by
- Hoa X. Nguyen, OPSWAT Unit 515 (CVE-2026-114612); GitHub user rekter0 (file read)
What changed with LiteLLM Proxy
On October 27, 2026, BerriAI published two GitHub security advisories for the LiteLLM proxy, the open-source gateway many teams put in front of OpenAI, Anthropic, Google and other model APIs. The main one, CVE-2026-114612, scores 9.9 under CVSS 3.1 and 7.7 under CVSS 4.0, and GitHub lists it as high severity. Hoa X. Nguyen of OPSWAT Unit 515 is credited with the discovery.
The proxy used one encryption key both to seal stored secrets and to mint session tokens. A user with the ordinary internal_user role could create an API key whose metadata contained a forged admin credential, receive the encrypted value back, and then present it as a bearer token. The proxy decrypted it and treated the caller as proxy_admin, which includes running arbitrary commands through the MCP stdio endpoint. BerriAI says versions from 1.91.0 are exploitable in the default configuration, and 1.87.0 to 1.90.x only when EXPERIMENTAL_UI_LOGIN=true is set. Fixed builds are 1.100.4, 1.101.3, 1.102.2, 1.103.1 and 1.104.0rc2, all released on September 30.
The second advisory has no CVE yet: a user with only the internal_user_viewer role, which many deployments grant through SSO, could make the proxy read any local file by passing a crafted vertex_ai_credentials value to /utils/transform_request. BerriAI notes that reading the process environment can expose LITELLM_MASTER_KEY and provider API keys. It is fixed in 1.95.0, and there is no reliable configuration workaround. Neither issue is on CISA's Known Exploited Vulnerabilities list as of November 5, 2026.
How to fix it: LiteLLM Proxy
1. Update
Upgrade the LiteLLM proxy to 1.100.4, 1.101.3, 1.102.2, 1.103.1 or a later release, and redeploy every proxy instance and container image.
github.com (opens in a new tab)2. Workaround
If you cannot upgrade immediately, set EXPERIMENTAL_UI_LOGIN=false. BerriAI notes this also breaks CLI SSO and Claude Code gateway login. It does not fix the file read, which requires 1.95.0 or later.
github.com (opens in a new tab)3. Monitor
Review who holds internal_user and internal_user_viewer roles, look for unexpected admin activity or new keys, and rotate LITELLM_MASTER_KEY and provider API keys if untrusted users could reach an affected version.
github.com (opens in a new tab)
Instruction for your AI agent
Search requirements files, lockfiles, Dockerfiles and deployment manifests for litellm or the LiteLLM proxy image. If the version is below 1.95.0, or is 1.91.0 or later but older than 1.100.4, 1.101.3, 1.102.2 or 1.103.1 in its line, propose upgrading to a fixed release. Do not rotate keys or change roles yourself; tell the user which keys and roles to review.
Based on the official guidance linked below. Review it before giving it to an agent that can change your systems.
Advisories
Where to compare LiteLLM Proxy
Independent leaderboards and official resources for comparing this model yourself. Rankings change often; each site shows its own current data.
Why LiteLLM Proxy matters for businesses
A model gateway holds every provider key you pay for, so a privilege bug there is a billing and data risk at once. If you run a LiteLLM proxy for your team or clients, upgrade to one of the fixed releases, review which accounts hold internal_user or internal_user_viewer roles, and rotate the master key and provider keys if untrusted users had access to an affected version.
Sources for this story
- LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key (opens in a new tab)Official
BerriAI on GitHub · github.com
- LiteLLM: internal_user_viewer arbitrary local file read via vertex_ai_credentials (opens in a new tab)Official
BerriAI on GitHub · github.com
- LiteLLM v1.100.4 release (opens in a new tab)Official
BerriAI on GitHub · github.com
- CVE-2026-114612 (opens in a new tab)Official
NIST National Vulnerability Database · nvd.nist.gov
Last verified: . IA Compa summarizes public announcements for business readers. We are not affiliated with the companies mentioned. Always confirm details, pricing, and availability with the official source.
- #security
- #cve
- #litellm
- #ai-gateway
- #privilege-escalation
- #mcp