8.7
High
CVE-2026-89032 BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that…
Description
BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other tenants' cached responses by exploiting a metadata key mismatch between _get_semantic_cache_tenant_scope() and _get_metadata_variable_name(). Attackers holding a valid virtual key can submit semantically similar prompts on affected routes such as /v1/responses and /bedrock/* to retrieve cached responses containing other tenants' personally identifiable information, financial data, or source code, and can cause agentic front-ends to auto-execute attacker-supplied tool calls under victim credentials by returning cached function_call or tool_calls payloads to a different principal.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| litellm 1.101 | earliest → < 1.101.0-rc.1 | 1.101.0-rc.1 |
References
- LiteLLM v1.101.0-rc.1 Release Notes github.com
- Pull Request github.com
- Patch Commit github.com
- www.vulncheck.com www.vulncheck.com
Timeline
- Published
- Last modified
Other CVEs of litellm
The 40 CVEs of litellm →
CVE-2026-114612
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format
9.9
Critical
CVE-2026-108575
A vulnerability has been found in BerriAI LiteLLM up to 1.94.0
5.3
Medium
CVE-2026-108574
A flaw has been found in BerriAI LiteLLM up to 1.95.0
5.3
Medium
CVE-2026-93355
LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured…
7.6
High