LiteLLM Proxy Patch Fixes Critical Admin Takeover Flaw in Versions Up to 1.104

LiteLLM proxy servers running versions between 1.87.0 and 1.104.0-rc.2 are affected by a critical security flaw that grants administrative access to authenticated internal users. The vendor has released patches for specific versions, including 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2. This issue was identified as CVE-2026-114612 and carries a CVSS score of 9.9.

How it unfolded

• The NVD record describes a cryptographic context reuse flaw in the LiteLLM proxy server, which acts as an AI Gateway for LLM APIs.
• The vulnerability allows an authenticated internal user to craft metadata containing a forged administrator credential that is encrypted and returned by the API-key flow.
• Replaying this ciphertext as a bearer token causes the proxy to trust the forged identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint.

Who is affected

The flaw impacts LiteLLM versions starting from 1.87.0 up to, but not including, 1.100.4. It also affects versions from 1.101.0 up to 1.101.3, from 1.102.0 up to 1.102.2, and from 1.103.0 up to 1.103.1. Additionally, version 1.104.0-rc.2 is affected. Versions 1.87.0 through 1.90.x require the EXPERIMENTAL_UI_LOGIN feature to be enabled for exploitation. Versions after 1.91.0 are exploitable in the default configuration.

Our take on the response

The availability of patches for multiple version branches indicates a comprehensive fix for this cryptographic reuse issue. The high severity rating reflects the potential for complete administrative takeover. As Patch Observer reported on 2026-10-16, similar high-severity flaws in infrastructure components like X.Org Server have required immediate attention. This LiteLLM issue demands similar urgency due to the critical CVSS score and the ease of exploitation in default configurations for newer versions.

Who needs to act first

Teams should prioritize updating externally accessible LiteLLM proxy instances first, as these pose the highest risk. Verify which versions are running across your environment to ensure all affected instances are patched. Test the update in a non-production environment before rolling it out broadly to avoid service disruptions. Back up configurations and databases prior to applying the patch. Monitor logs for any signs of unauthorized administrative access or unusual token usage during the transition period.

What to do and how to stay safe: LiteLLM

• Identify all LiteLLM proxy instances running versions between 1.87.0 and 1.104.0-rc.2.
• Apply the available patches for versions 1.100.4, 1.101.3, 1.102.2, 1.103.1, or 1.104.0-rc.2 as soon as possible.
• Review access logs for any suspicious administrative actions or forged token usage prior to patching.
• Ensure that the EXPERIMENTAL_UI_LOGIN feature is disabled if you are running versions 1.87.0 through 1.90.x.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-114612?

The CVSS score for CVE-2026-114612 is 9.9, which is rated as critical.

Which LiteLLM versions are not affected by this flaw?

Versions prior to 1.87.0 and versions 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2 are not affected.

Does the flaw require the EXPERIMENTAL_UI_LOGIN feature to be enabled?

Only for versions 1.87.0 through 1.90.x; versions after 1.91.0 are exploitable in the default configuration.