Security brief

LiteLLM key reuse could let internal users become proxy administrators

REVIEW

A LiteLLM proxy flaw crosses an authentication boundary. Check branch-specific fixes and login configuration.

Published 29 Oct 2026 · Material update 27 Oct 2026 — last time the underlying evidence changed · Evidence: high

What happened

A reviewed LiteLLM advisory describes a privilege-escalation path from an authenticated internal account to proxy administrator, with potential command execution on the host.

The underlying problem is reuse of an encryption key for stored secrets and session credentials. Material produced for one purpose could be accepted in the other context.

Check the release branch and configuration

The advisory lists several affected ranges starting at 1.91.0, with branch-specific fixes including 1.100.4, 1.101.3, 1.102.2, and 1.103.1. It also describes conditional exposure in older releases when experimental UI login is enabled. Consult the complete version table before deciding applicability.

Its temporary mitigation disables EXPERIMENTAL_UI_LOGIN, but that also disrupts CLI SSO and Claude Code gateway login. This is a LiteLLM proxy issue; that integration impact does not establish a vulnerability in Claude itself.

Read advisory GHSA-7hp6-4w63-5g45.

Who should check?

Operators of LiteLLM proxies with authenticated internal users.

Next step

Check the complete affected-version table and install the fix for your release branch.

What we know

Affected product: LiteLLM proxy
Required access: Authenticated internal user

What remains unknown

Open question: Your deployment configuration and exploitation history have not been assessed.

Source references

GIT

GitHub Advisory Database LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key

Technical details

CVE: CVE-2026-114612