What happened
VulnCheck disclosed (published 25 Sept 2026) a tenant-isolation bypass in LiteLLM's semantic cache where tenant scoping and metadata variable name are derived inconsistently, letting an authenticated user on one tenant retrieve cached responses (including agentic function_call/tool_calls payloads) from another tenant.
Why it matters
LiteLLM sits in front of most agentic/LLM production traffic; this breach crosses tenant boundaries in a shared gateway and - critically - can return cached tool_call payloads to a different principal, forcing agentic front-ends to act under the victim's identity. High-value cross-tenant compromise of AI infrastructure.
Attack vector
Authenticated users holding a valid virtual key submit semantically similar prompts on routes like /v1/responses and /bedrock/* to read other tenants' cached responses (PII, financial data, source code) via a metadata-key mismatch in the semantic cache tenant scoping; cached function_call/tool_calls payloads returned to a different principal can auto-execute attacker-supplied tool calls under victim credentials in agentic front-ends.
Affected systems
BerriAI LiteLLM before 1.101.0-rc.1 (semantic cache layer)
Mitigation
Upgrade to LiteLLM >= 1.101.0-rc.1 (fix commit 16db51e2cfc28e02bd460481e634a8403ea9265e, PR 39590); consider disabling semantic caching in multi-tenant deployments until patched.