LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 1.100.4, 1.101.3, 1.102.2, 1.103.1, 1.104.0-rc.2
- Public exploit
- None on Exploit-DB
Summary
LiteLLM, an open-source proxy server that routes calls to large language model APIs, is affected by this flaw. An authenticated internal user could forge an administrator credential and use it to gain full proxy admin access and run arbitrary commands.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow. Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require EXPERIMENTAL_UI_LOGIN to be enabled, while versions after 1.91.0 are exploitable in the default configuration. This issue was fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2.
Affected versions
- BerriAI litellm
From 1.87.0 · fixed in 1.100.4; From 1.101.0 · fixed in 1.101.3; From 1.102.0 · fixed in 1.102.2; From 1.103.0 · fixed in 1.103.1; From 1.104.0-rc.1 · fixed in 1.104.0-rc.2