~ / search / GHSA-7hp6-4w63-5g45

GHSA-7hp6-4w63-5g45

LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key

Source: GitHub Advisory Database (reviewed) High CVE-2026-114612

Packages

EcosystemPackageAffectedFixed in
PyPI litellm >= 1.91.0, < 1.100.4 1.100.4
PyPI litellm >= 1.101.0, < 1.101.3 1.101.3
PyPI litellm >= 1.102.0, < 1.102.2 1.102.2
PyPI litellm >= 1.103.0, < 1.103.1 1.103.1
PyPI litellm >= 1.104.0rc1, < 1.104.0rc2 1.104.0rc2

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary An authenticated user with `internal_user` privileges can escalate to `proxy_admin` and achieve remote code execution. The proxy uses one encryption key for two purposes: sealing secrets at rest and minting session tokens. An attacker exploits this by requesting a new API key with a crafted metadata field containing a forged admin credential as the "secret" value. The proxy encrypts and returns this payload. When this value is then presented as a bearer token, the proxy decrypts it, trusts the forged admin identity, and grants full administrative access, including the ability to execute arbitrary commands via the MCP stdio endpoint. ### Affected versions Versions later than 1.91.0 are exploitable in the default configuration. Versions 1.87.0 through 1.90.x are exploitable only if `EXPERIMENTAL_UI_LOGIN=true` was explicitly set. ### Mitigation Upgrade to a patched version as soon as possible. If you cannot upgrade immediately, set `EXPERIMENTAL_UI_LOGIN=false`. This disables the vulnerable authentication path but also breaks CLI SSO and Claude Code gateway login. ### Impact An internal user can escalate to proxy admin and execute arbitrary commands on the host. **Discovery Credit:** Hoa X. Nguyen (OPSWAT Unit 515)

References

External links from the advisory. They lead to third-party sites.