External risk intelligence

LiteLLM Proxy Allows Forged Administrator Credentials and Command Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-114612

LiteLLM is explicitly designed as a proxy server and AI Gateway. These services are typically deployed as edge gateways to facilitate API calls between internal applications and external LLM providers, making the service commonly reachable and exposed to the networks where these applications operate.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in LiteLLM, a proxy server for AI model APIs. This issue could allow an authenticated internal user to gain administrative access and execute arbitrary commands. The main concern is confirming the relevance and exposure of this technology within our environment.

Vulnerability allows unauthorized administrative control.
It impacts systems processing AI model requests.
Confirm LiteLLM usage and exposure internally.

Attack Path

How an attacker could exploit the issue

An attacker with internal network access could exploit this vulnerability by crafting specific metadata within API calls. This crafted data is then encrypted by the proxy's API-key flow, effectively forging administrator credentials. By replaying this forged credential as a session token, the attacker can gain administrative control and execute arbitrary commands.

Requires authenticated internal access.
Triggers via crafted API metadata.
Leads to administrative takeover and command execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an authenticated internal user could potentially forge administrator credentials. This could then be used to gain administrative access to the proxy server and execute arbitrary commands through its standard input/output endpoint.

Proxy administrative access and commands.
Forged credentials via API-key flow.
Compromised system control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The LiteLLM proxy server, used as an AI Gateway, is likely managed by platform or infrastructure teams responsible for its deployment and availability. Initial actions should focus on identifying all instances of LiteLLM, assessing their reachability and business criticality, and confirming the accountable owner for each. This information will guide a risk-based remediation plan.

Platform or infrastructure teams should own.
Verify LiteLLM instance reachability and criticality.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is LiteLLM?

LiteLLM is a proxy server designed to act as an AI Gateway. It simplifies how applications connect to various Large Language Model (LLM) APIs, such as OpenAI, by providing a unified interface that translates requests into the format those models expect. By centralizing these connections, organizations can manage API calls, authentication, and routing for multiple AI services in one location.

How does CVE-2026-114612 allow credential forgery?

This vulnerability involves improper authentication and insufficient verification, classified as CWE-269, CWE-345, and CWE-441. Due to how the proxy handles cryptographic contexts, an attacker can submit crafted metadata that the system incorrectly encrypts and returns as a valid-looking credential. Reusing this output allows the attacker to impersonate an administrator and gain unauthorized control over the proxy's administrative functions.

Do I need to be an administrator to trigger this bug?

No, you do not need to start with administrative privileges. The issue requires the attacker to be an authenticated internal user of the proxy. While older versions (1.87.0 through 1.90.x) only allow this if the EXPERIMENTAL_UI_LOGIN feature is enabled, newer versions are vulnerable in their default configuration. This bug is not triggered by unauthenticated users or those completely outside the local network.

Is my instance of LiteLLM at risk?

According to Halo Surface Signal, LiteLLM is often deployed as an edge gateway to facilitate traffic between internal applications and external LLM providers. Because of this design, these servers are frequently positioned to be reachable within the networks where applications reside. If your proxy is accessible to internal users, it may be a target for this credential-forgery path.

What steps should I take if I run LiteLLM?

Start by identifying all instances of LiteLLM currently active in your infrastructure. Determine which versions are in use and verify their reachability across your internal networks. Once you have a clear inventory, prioritize updating your servers to one of the patched versions—1.100.4, 1.101.3, 1.102.2, 1.103.1, or 1.104.0-rc.2—to secure the API-key flow and prevent administrative impersonation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.