CVE-2026-114612: LiteLLM forged admin token

Q: Is CVE-2026-114612 actively exploited?

No confirmed active exploitation of CVE-2026-114612 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-114612?

1) Upgrade to a fixed release: 1.100.4, 1.101.3, 1.102.2, 1.103.1 or 1.104.0-rc.2. 2) On 1.87.0 through 1.90.x, disable EXPERIMENTAL_UI_LOGIN as an interim measure; versions after 1.91.0 have no such workaround, so patch or restrict access. 3) Limit network exposure of the proxy to trusted segments and cut off untrusted internal users. 4) Disable or restrict the MCP stdio endpoint if it is not needed. 5) After patching, rotate the LiteLLM master and salt keys, all virtual keys and the upstream provider credentials, because the encrypted metadata may have been forged earlier. 6) Detect: look for API-key generation requests with unusual metadata, bearer tokens that do not match issued keys, admin actions from non-admin users, and unexpected child processes spawned by the proxy. 7) Run the proxy as a non-root user in a hardened container with minimal egress.

Q: What systems are affected by CVE-2026-114612?

This vulnerability affects the following AI/ML architecture patterns: LLM gateways and proxies, Agent frameworks using MCP, Multi-tenant model serving, RAG pipelines routed through LiteLLM, Centralized LLM API key management.

Q: What is the CVSS score for CVE-2026-114612?

CVE-2026-114612 has a CVSS v3.1 base score of 9.9 (CRITICAL). The EPSS exploitation probability is 0.32%.

CISO Take

LiteLLM, a widely used AI gateway, reuses one cryptographic context for stored secrets and session tokens, so any authenticated internal user can get the API-key flow to encrypt a forged administrator credential and then replay it as a bearer token. The result is full proxy administrator access and arbitrary command execution through the MCP stdio endpoint, which is why this is rated critical (CVSS 9.9, scope changed, low privileges, no user interaction). Versions after 1.91.0 are exploitable in the default configuration, and 1.87.0 through 1.90.x only when EXPERIMENTAL_UI_LOGIN is enabled. At publication there is no EPSS score, no KEV listing, no public exploit and no Nuclei template, but the commits that fix it are public and show the flaw, so a working exploit should be expected quickly. Upgrade to 1.100.4, 1.101.3, 1.102.2, 1.103.1 or 1.104.0-rc.2 now, rotate the master key, provider keys and any credentials stored on the proxy, and review the audit logs for unexpected admin actions and MCP stdio calls.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Critical. Exploitation needs only low-privilege authenticated access (any internal user or API key holder), is network-reachable, has low complexity and needs no user interaction. The changed scope reflects that compromising the gateway exposes the host and everything it connects to. Mixing the keys used for secret encryption and session tokens is a design flaw, which makes the exploit reliable and repeatable. No exploitation in the wild is reported and no EPSS or KEV data was available at publication (confidence: MEDIUM on exploitation likelihood, HIGH on technical severity). The risk is highest for multi-tenant gateways where many internal teams or contractors hold virtual keys.

How does the attack unfold?

Initial Access

The attacker authenticates with a low-privilege internal LiteLLM user or key.

AML.T0012

Token Forgery

Crafted key metadata containing an administrator credential is encrypted and returned by the API-key flow, because the same cryptographic context is used for secrets and session tokens.

AML.T0091.000

Privilege Escalation

The attacker replays the ciphertext as a bearer token and the proxy trusts the forged proxy administrator identity.

AML.T0091.000

Impact

The attacker runs arbitrary commands through the MCP stdio endpoint, steals provider keys and takes over the gateway host.

AML.T0050

Initial Access

The attacker authenticates with a low-privilege internal LiteLLM user or key.

AML.T0012

Token Forgery

Crafted key metadata containing an administrator credential is encrypted and returned by the API-key flow, because the same cryptographic context is used for secrets and session tokens.

AML.T0091.000

Privilege Escalation

The attacker replays the ciphertext as a bearer token and the proxy trusts the forged proxy administrator identity.

AML.T0091.000

Impact

The attacker runs arbitrary commands through the MCP stdio endpoint, steals provider keys and takes over the gateway host.

AML.T0050

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LiteLLM	pip	>= 1.91.0, < 1.100.4	`1.100.4`
62.0KOpenSSF 6.0Pushed 6d ago51% patched~47d to patchFull package profile →

Do you use LiteLLM? You're affected.

How severe is it?

CVSS 3.1

9.9 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 25% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SChanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade to a fixed release: 1.100.4, 1.101.3, 1.102.2, 1.103.1 or 1.104.0-rc.2. 2) On 1.87.0 through 1.90.x, disable EXPERIMENTAL_UI_LOGIN as an interim measure; versions after 1.91.0 have no such workaround, so patch or restrict access. 3) Limit network exposure of the proxy to trusted segments and cut off untrusted internal users. 4) Disable or restrict the MCP stdio endpoint if it is not needed. 5) After patching, rotate the LiteLLM master and salt keys, all virtual keys and the upstream provider credentials, because the encrypted metadata may have been forged earlier. 6) Detect: look for API-key generation requests with unusual metadata, bearer tokens that do not match issued keys, admin actions from non-admin users, and unexpected child processes spawned by the proxy. 7) Run the proxy as a non-root user in a hardened container with minimal egress.

How is it classified?

Auth BypassCode ExecutionAPIFrameworkPluginAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0053- AI Agent Tool Invocation AML.T0091.000- Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to unknown risks and emergent incidents

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-114612?

LiteLLM, a widely used AI gateway, reuses one cryptographic context for stored secrets and session tokens, so any authenticated internal user can get the API-key flow to encrypt a forged administrator credential and then replay it as a bearer token. The result is full proxy administrator access and arbitrary command execution through the MCP stdio endpoint, which is why this is rated critical (CVSS 9.9, scope changed, low privileges, no user interaction). Versions after 1.91.0 are exploitable in the default configuration, and 1.87.0 through 1.90.x only when EXPERIMENTAL_UI_LOGIN is enabled. At publication there is no EPSS score, no KEV listing, no public exploit and no Nuclei template, but the commits that fix it are public and show the flaw, so a working exploit should be expected quickly. Upgrade to 1.100.4, 1.101.3, 1.102.2, 1.103.1 or 1.104.0-rc.2 now, rotate the master key, provider keys and any credentials stored on the proxy, and review the audit logs for unexpected admin actions and MCP stdio calls.

Is CVE-2026-114612 actively exploited?

No confirmed active exploitation of CVE-2026-114612 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-114612?

1) Upgrade to a fixed release: 1.100.4, 1.101.3, 1.102.2, 1.103.1 or 1.104.0-rc.2. 2) On 1.87.0 through 1.90.x, disable EXPERIMENTAL_UI_LOGIN as an interim measure; versions after 1.91.0 have no such workaround, so patch or restrict access. 3) Limit network exposure of the proxy to trusted segments and cut off untrusted internal users. 4) Disable or restrict the MCP stdio endpoint if it is not needed. 5) After patching, rotate the LiteLLM master and salt keys, all virtual keys and the upstream provider credentials, because the encrypted metadata may have been forged earlier. 6) Detect: look for API-key generation requests with unusual metadata, bearer tokens that do not match issued keys, admin actions from non-admin users, and unexpected child processes spawned by the proxy. 7) Run the proxy as a non-root user in a hardened container with minimal egress.

What systems are affected by CVE-2026-114612?

This vulnerability affects the following AI/ML architecture patterns: LLM gateways and proxies, Agent frameworks using MCP, Multi-tenant model serving, RAG pipelines routed through LiteLLM, Centralized LLM API key management.

What is the CVSS score for CVE-2026-114612?

CVE-2026-114612 has a CVSS v3.1 base score of 9.9 (CRITICAL). The EPSS exploitation probability is 0.32%.

What is the AI security impact?

Affected AI Architectures

LLM gateways and proxiesAgent frameworks using MCPMulti-tenant model servingRAG pipelines routed through LiteLLMCentralized LLM API key management

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0053AI Agent Tool Invocation

AML.T0091.000Application Access Token

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow. Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require EXPERIMENTAL_UI_LOGIN to be enabled, while versions after 1.91.0 are exploitable in the default configuration. This issue was fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2.

Exploitation Scenario

An attacker holds a low-privilege internal LiteLLM key, for example a developer virtual key or a stolen key from a leaked repository. They call the API-key generation flow with crafted metadata that contains a serialized proxy administrator credential, and the proxy returns it encrypted with the same cryptographic context used for session tokens. The attacker replays that ciphertext as a bearer token, and the proxy accepts it as the proxy administrator. They then call the MCP stdio endpoint to run commands on the host, dump provider API keys and environment variables, and install persistence, or silently log all prompts that pass through the gateway.

Weaknesses (CWE)

CWE-269Improper Privilege ManagementPrimary CWE-269Improper Privilege ManagementPrimary CWE-345Insufficient Verification of Data AuthenticityPrimary CWE-345Insufficient Verification of Data AuthenticityPrimary CWE-441Unintended Proxy or Intermediary ('Confused Deputy')Primary CWE-441Unintended Proxy or Intermediary ('Confused Deputy')Primary CWE-269Improper Privilege Management CWE-345Insufficient Verification of Data Authenticity CWE-441Unintended Proxy or Intermediary ('Confused Deputy')

CWE-269 — Improper Privilege Management: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design] Follow the principle of least privilege when assigning access rights to entities in a software system.

Source: MITRE CWE corpus.