Does Your LiteLLM Proxy Need Patching for CVSS 9.9 CVE-2026-114612?

Authenticated users of the LiteLLM proxy server can forge administrator credentials due to a cryptographic flaw, according to the National Vulnerability Database. The vulnerability, tracked as CVE-2026-114612, allows an attacker with internal access to craft metadata containing a fake admin identity. By replaying this encrypted data as a bearer token, the proxy trusts the forged credentials, granting the user full administrative access and the ability to run arbitrary commands through the Model Context Protocol standard input/output endpoint.

How does the cryptographic flaw work?

The LiteLLM proxy reuses a single cryptographic context for both at-rest secrets and session tokens, according to the NVD record. This design error enables an authenticated internal user to manipulate the API-key flow. The user can have crafted metadata containing a forged administrator credential encrypted by the system. When this ciphertext is replayed as a bearer token, the proxy decrypts it using the same context, validating the fake identity. This bypasses normal authentication checks and elevates the user’s privileges to the highest level available in the proxy.

Which versions are affected?

The vulnerability impacts LiteLLM proxy versions starting from 1.87.0, according to the NVD. It affects versions less than 1.100.4, less than 1.101.3, less than 1.102.2, less than 1.103.1, and less than 1.104.0-rc.2. The exploitability depends on the specific version range. For versions 1.87.0 through 1.90.x, the EXPERIMENTAL_UI_LOGIN feature must be enabled for the attack to succeed. However, for versions after 1.91.0, the flaw is exploitable in the default configuration, meaning no special settings are required for an attacker to leverage the bug.

Is a fix available?

Yes, the vendor has released patches for the affected versions, according to the NVD record. Users should update to LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, or 1.104.0-rc.2. These updates address the cryptographic context reuse issue. The National Vulnerability Database rates the severity of CVE-2026-114612 as critical with a CVSS score of 9.9. The underlying weaknesses are classified as CWE-269, CWE-345, and CWE-441. Applying the latest patch is the only confirmed way to mitigate this specific administrative takeover risk.

What analysts watch for

Teams usually monitor for unusual privilege escalation patterns in proxy logs. Analysts check whether authenticated users are generating or replaying bearer tokens that result in administrative actions. They examine metadata payloads for signs of crafted encryption attempts. Persistence is often linked to the creation of new admin accounts or the modification of existing configurations. Spread occurs when attackers use the compromised proxy to issue arbitrary commands via the MCP stdio endpoint. Investigators look for anomalies in token generation frequencies and unexpected access to sensitive API keys.

Background: CVSS score

The CVSS score provides a standardized number to rank vulnerability severity. Small teams should use it to prioritize patches, but must adjust for business context. A high score does not always mean immediate danger if the affected component is isolated or unused.

Read the full guide: CVSS Scores Explained: What Small Teams Must Know

What to do and how to stay safe: LiteLLM

• Update your LiteLLM proxy installation to the latest patched version immediately.
• Review access logs for any authenticated users who recently gained administrative privileges.
• Rotate all API keys and session tokens if you suspect the proxy was compromised.
• Disable the EXPERIMENTAL_UI_LOGIN feature if you are running an older affected version.

Step-by-step guide: 7 Privilege Escalation Mistakes That Leave Systems Exposed

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-114612?

The National Vulnerability Database rates CVE-2026-114612 as critical with a CVSS score of 9.9.

Do I need EXPERIMENTAL_UI_LOGIN enabled to be exploited?

Only for versions 1.87.0 through 1.90.x. Versions after 1.91.0 are exploitable in the default configuration.

Which versions are fixed?

Versions 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2 contain the fix.