CVE-2026-114612: LiteLLM admin access via forged credential replay enables MCP stdio commands

Summary

LiteLLM, a proxy server (AI Gateway) for calling LLM APIs, reuses one cryptographic context for at-rest secrets and session tokens from 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2. An authenticated internal user can embed a forged administrator credential in metadata, which the API-key flow encrypts and returns; replaying that ciphertext as a bearer token makes the proxy trust the forged identity, granting administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require EXPERIMENTAL_UI_LOGIN to be enabled, while versions after 1.91.0 are exploitable in the default configuration.

Mitigation

Fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2.

Related items

• MediumGitLab critical patches include one for a bug that allows code execution by unauthenticated usersSimilar attack · CSO Online
• HighCVE-2026-115419 - Unintended disclosure of data element to wrong session in Strands Agents SDK A2A ServerSimilar attack · AWS Security Bulletins
• LowThird-party evaluators found vulnerabilities in OpenAI monitoring system during test pilotSimilar attack · CNBC Technology
• InfoSomeone hacked the Switch 2 by using an old game and AISimilar attack · The Verge (AI)
• MediumChinese hackers spied on thousands of companies after breaching IT giant ConnectWiseSimilar attack · TechCrunch (Security)