무슨 일이 있었나
LiteLLM's proxy reused a single cryptographic context for both at-rest encrypted secrets and session tokens. An authenticated internal attacker could forge an administrator credential, have it encrypted by the normal API-key flow, and then replay the resulting ciphertext as a bearer token — the proxy trusted the forged admin identity. This yields admin access and arbitrary command execution through the MCP stdio endpoint. Published 2026-10-22, CVSS 9.9 (network, low privileges, scope-changed).
왜 중요한가
An LLM gateway is the choke point between an organization and its model providers. Privilege escalation to proxy-administrator in the default configuration means an attacker can read/rotate provider keys, inspect prompts and responses, and drive the gateway's MCP tool surface — classic gateway-level compromise of an AI deployment. Distinct from the earlier Oct 21 LiteLLM release-pipeline supply-chain incident: this is an authentication/privilege flaw in the proxy itself.
공격 경로
The proxy reuses one cryptographic context for at-rest secrets and session tokens. A low-privilege authenticated internal user crafts metadata containing a forged administrator credential that the API-key flow encrypts; replaying that ciphertext as a bearer token makes the proxy trust a forged admin identity, granting administrative access and arbitrary commands through the MCP stdio endpoint. From 1.91.0 onward this is exploitable in the default configuration (1.87.0–1.90.x needed EXPERIMENTAL_UI_LOGIN).
영향받는 시스템
LiteLLM (BerriAI/litellm) 1.87.0–1.100.4, 1.101.0–1.101.3, 1.102.0–1.102.2, 1.103.0–1.103.1, 1.104.0-rc.1–rc.2
완화 방안
Upgrade to fixed versions 1.100.4 / 1.101.3 / 1.102.2 / 1.103.1 / 1.104.0-rc.2. GitHub advisory GHSA-7hp6-4w63-5g45. Rotate any secrets/keys reachable via the gateway.