Summary
LiteLLM contains a cryptographic-context reuse flaw that can allow an authenticated internal user to obtain a forged administrator credential and have the proxy accept it as a bearer token. Successful exploitation may grant administrative access and enable arbitrary command execution through the MCP stdio endpoint, with exposure depending on the deployment configuration.
LiteLLM contains a cryptographic-context reuse flaw that can allow an authenticated internal user to obtain a forged administrator credential and have the proxy accept it as a bearer token. Successful exploitation may grant administrative access and enable arbitrary command execution through the MCP stdio endpoint, with exposure depending on the deployment configuration.
Affected context
The issue occurs in LiteLLM proxy deployments where the same cryptographic context is used for both at-rest secrets and session tokens. An authenticated internal user must be able to influence metadata processed by the API-key flow and receive the resulting encrypted credential. Later LiteLLM configurations are generally exposed under default settings, while older affected releases require the experimental UI login feature to be enabled.
The issue occurs in LiteLLM proxy deployments where the same cryptographic context is used for both at-rest secrets and session tokens. An authenticated internal user must be able to influence metadata processed by the API-key flow and receive the resulting encrypted credential. Later LiteLLM configurations are generally exposed under default settings, while older affected releases require the experimental UI login feature to be enabled.
Exploit preconditions
- Attack surface: LiteLLM proxy API-key and authentication flows, including the MCP stdio endpoint
- Required access: An authenticated internal account with the ability to provide or influence relevant metadata
- Trigger point: Processing API-key metadata and subsequent bearer-token authentication
- Why exploitation is possible: Cryptographic contexts intended for different security purposes are reused, allowing a ciphertext produced for one purpose to be accepted as an administrator session credential
- Attack surface: LiteLLM proxy API-key and authentication flows, including the MCP stdio endpoint
- Required access: An authenticated internal account with the ability to provide or influence relevant metadata
- Trigger point: Processing API-key metadata and subsequent bearer-token authentication
- Why exploitation is possible: Cryptographic contexts intended for different security purposes are reused, allowing a ciphertext produced for one purpose to be accepted as an administrator session credential
Why this happens
The underlying flaw is a failure to separate cryptographic domains for at-rest secrets and authentication tokens. Because the proxy reuses one cryptographic context across these purposes, authenticated users may obtain ciphertext that is valid in a different trust context and have it interpreted as a privileged identity. This behavior maps primarily to CWE-269: Improper Privilege Management, with related concerns involving CWE-345: Insufficient Verification of Data Authenticity and CWE-441: Unintended Proxy or Intermediary ('Confused Deputy').
The underlying flaw is a failure to separate cryptographic domains for at-rest secrets and authentication tokens. Because the proxy reuses one cryptographic context across these purposes, authenticated users may obtain ciphertext that is valid in a different trust context and have it interpreted as a privileged identity. This behavior maps primarily to CWE-269: Improper Privilege Management, with related concerns involving CWE-345: Insufficient Verification of Data Authenticity and CWE-441: Unintended Proxy or Intermediary ('Confused Deputy').
Potential impact
- An attacker may bypass intended administrator authentication
- An attacker could gain control over LiteLLM administrative functions
- Arbitrary commands may be executed through the MCP stdio endpoint
- Connected model providers, credentials, or proxy configuration may be exposed or altered
- The proxy could be used as a privileged intermediary for further compromise
- An attacker may bypass intended administrator authentication
- An attacker could gain control over LiteLLM administrative functions
- Arbitrary commands may be executed through the MCP stdio endpoint
- Connected model providers, credentials, or proxy configuration may be exposed or altered
- The proxy could be used as a privileged intermediary for further compromise
General mitigation guidance
Mitigation should focus on separating cryptographic purposes and strengthening privilege boundaries.
Defensive patterns include:
- Use distinct cryptographic keys, contexts, labels, and verification paths for stored secrets, session tokens, and administrator credentials
- Apply domain separation and explicit token-purpose validation before accepting authentication material
- Bind bearer tokens to narrowly defined identities, audiences, issuers, and lifetimes
- Avoid returning encrypted authentication material in responses to lower-privileged users
- Require independent authorization checks for administrative operations and MCP command execution
- Run MCP and proxy components with least privilege and restrict access to sensitive provider credentials
- Disable unnecessary administrative or experimental authentication surfaces and enforce secure defaults
- Monitor and rotate potentially exposed signing or encryption material according to incident-response procedures
Mitigation should focus on separating cryptographic purposes and strengthening privilege boundaries.
Defensive patterns include:
- Use distinct cryptographic keys, contexts, labels, and verification paths for stored secrets, session tokens, and administrator credentials
- Apply domain separation and explicit token-purpose validation before accepting authentication material
- Bind bearer tokens to narrowly defined identities, audiences, issuers, and lifetimes
- Avoid returning encrypted authentication material in responses to lower-privileged users
- Require independent authorization checks for administrative operations and MCP command execution
- Run MCP and proxy components with least privilege and restrict access to sensitive provider credentials
- Disable unnecessary administrative or experimental authentication surfaces and enforce secure defaults
- Monitor and rotate potentially exposed signing or encryption material according to incident-response procedures
How teams detect issues like this
Detection can combine code review, static analysis, and runtime monitoring:
- Search for shared encryption or signing contexts used across secrets storage and authentication-token workflows
- Review whether token validation distinguishes purpose, audience, issuer, identity, and privilege level
- Flag API responses that return ciphertext or credential-like metadata to authenticated but non-administrative users
- Inspect authorization checks around API-key generation, administrator endpoints, and MCP command execution
- Enforce architectural policies requiring cryptographic domain separation and least-privilege service accounts
- Monitor for unusual administrator-token issuance, replay, privilege changes, and MCP process launches
- Use automated security review tools to identify credential confusion and missing authorization-boundary checks
Detection can combine code review, static analysis, and runtime monitoring:
- Search for shared encryption or signing contexts used across secrets storage and authentication-token workflows
- Review whether token validation distinguishes purpose, audience, issuer, identity, and privilege level
- Flag API responses that return ciphertext or credential-like metadata to authenticated but non-administrative users
- Inspect authorization checks around API-key generation, administrator endpoints, and MCP command execution
- Enforce architectural policies requiring cryptographic domain separation and least-privilege service accounts
- Monitor for unusual administrator-token issuance, replay, privilege changes, and MCP process launches
- Use automated security review tools to identify credential confusion and missing authorization-boundary checks
