Cafiyn Pulse
← Startup Signals
6 min readUpdated 2026-10-02Issue 5

Your AI gateway holds every provider key you have. A 9.9 just landed in LiteLLM.

An AI gateway concentrates every upstream key into one process. That is the point of it, and it is why a privilege escalation there is worse than it looks.

ByKarthik KumarCafiyn Innovations
At a glance
Critical advisory
GHSA-7hp6-4w63-5g45, CVSS 9.9, published 30 September 2026
Effect
internal_user escalates to proxy_admin, then remote code execution
Patched in
1.100.4, 1.101.3, 1.102.2, 1.103.1, 1.104.0rc2
Also
GHSA-g5ff-637f-6q2m, CVSS 8.1, arbitrary file read, fixed in 1.95.0
And
GHSA-hhww-mrg2-969h, reflected XSS, fixed in 1.85.0
CVE ids
None assigned to any of the three

What the critical one does

The advisory is blunt: "An authenticated user with internal_user privileges can escalate to proxy_admin and achieve remote code execution." It is rated 9.9, which is about as high as a flaw requiring authentication gets.

The root cause is a design error rather than a coding slip. In the advisory's words, "The proxy uses one encryption key for two purposes: sealing secrets at rest and minting session tokens." Because the same key does both jobs, a low-privilege user can get the proxy to encrypt attacker-chosen admin metadata as though it were a secret, then present the result back as a bearer token. The proxy decrypts it, believes the forged admin identity, and grants full administrative access, including command execution through the MCP stdio endpoint.

Every LiteLLM deployment has internal users. That is the ordinary role you hand to a developer or a team so they can use the gateway. The precondition here is not a sophisticated foothold, it is a normal account.

The patch for your line

LiteLLM maintains several release lines, so there is no single upgrade target. The advisory lists five affected ranges and five matching patched versions.

  • 1.91.0 up to 1.100.4, patched in 1.100.4
  • 1.101.0 up to 1.101.3, patched in 1.101.3
  • 1.102.0 up to 1.102.2, patched in 1.102.2
  • 1.103.0 up to 1.103.1, patched in 1.103.1
  • 1.104.0rc1 up to 1.104.0rc2, patched in 1.104.0rc2
  • Versions 1.87.0 through 1.90.x are exploitable only if EXPERIMENTAL_UI_LOGIN was explicitly set to true, so being below 1.91.0 is not automatically safe

The workaround has a price

If you cannot upgrade today, the advisory offers one mitigation: set EXPERIMENTAL_UI_LOGIN=false. It also says what that costs, and this part tends to get dropped in summaries: it "disables the vulnerable authentication path but also breaks CLI SSO and Claude Code gateway login".

So it is a real option, not a free one. If your developers sign in to the gateway through CLI SSO, flipping that flag at 6pm on a Friday trades a security problem for an availability one. Know which you are choosing.

The second one is worse than its rating suggests

A high severity advisory published 1 October, GHSA-g5ff-637f-6q2m at CVSS 8.1, lets an authenticated low-privilege user read arbitrary local files from the proxy runtime. The mechanism is a missed alias: the request-body safety blocklist rejected vertex_credentials but not vertex_ai_credentials, so a crafted value sent to the transform_request endpoint slipped through.

The advisory spells out where that leads: "Reading files such as /proc/self/environ can disclose LITELLM_MASTER_KEY and provider API keys, so the impact can escalate to full proxy-admin control." In other words, a file read becomes the same outcome as the critical, by a different route.

There is no mitigation to fall back on here. The advisory says directly that no reliable configuration workaround exists on affected versions. The fix is 1.95.0.

A third advisory, a reflected cross-site scripting issue in the SSO debug callback, is rated moderate at 6.8 and fixed in 1.85.0. Its impact section mentions full admin account takeover, so the moderate label undersells it in prose. None of the three has a CVE assigned, which means a scanner keyed on CVE ids will not flag any of them.

Why upgrading is only half the job

This is the part teams skip, and it is the part that matters. Both the critical and the high end in exposure of the gateway's master key and the upstream provider keys it holds. If you were running an affected version and exposed to internal users, you should treat those secrets as potentially known.

An AI gateway is a deliberate concentration of credentials. You put it in front of your models precisely so that the OpenAI key, the Anthropic key, the Bedrock credentials and the rest live in one place with one access policy. That is good design, and it means the blast radius of a gateway compromise is every model vendor you use, not the gateway alone.

So the rotation list is longer than it first appears, and the order matters: rotate the things that let an attacker keep access before you rotate the things that merely cost money.

  • Rotate LITELLM_MASTER_KEY first
  • Rotate every upstream provider API key the proxy holds
  • Reissue the virtual keys you have handed to teams and applications
  • Review which accounts hold internal_user and whether they all still need it
  • Check logs for requests to the transform_request endpoint carrying vertex_ai_credentials, and for hits on the SSO debug callback
  • Look for key generation calls whose metadata contains admin role strings, followed by unexpected proxy_admin activity

What to do

  1. 1Upgrade to the patched version on your release line: 1.100.4, 1.101.3, 1.102.2, 1.103.1 or 1.104.0rc2.
  2. 2If you are on 1.87.0 to 1.90.x, check whether EXPERIMENTAL_UI_LOGIN was ever set to true.
  3. 3Rotate the LiteLLM master key, then every upstream provider key, then reissue virtual keys.
  4. 4If you must use the EXPERIMENTAL_UI_LOGIN=false workaround, know that it breaks CLI SSO and Claude Code gateway login.
  5. 5Upgrade to 1.95.0 or later for the file read issue, which has no configuration workaround.
  6. 6Search logs for transform_request calls carrying vertex_ai_credentials and for SSO debug callback hits.

Common questions

Which LiteLLM versions are affected by the critical advisory?

Five ranges: 1.91.0 to 1.100.4, 1.101.0 to 1.101.3, 1.102.0 to 1.102.2, 1.103.0 to 1.103.1, and 1.104.0rc1 to 1.104.0rc2. Patched in 1.100.4, 1.101.3, 1.102.2, 1.103.1 and 1.104.0rc2 respectively.

Am I safe on a version below 1.91.0?

Not necessarily. The advisory says 1.87.0 through 1.90.x are exploitable if EXPERIMENTAL_UI_LOGIN was explicitly set to true. Versions later than 1.91.0 are exploitable in the default configuration.

What does the EXPERIMENTAL_UI_LOGIN=false workaround break?

The advisory says it disables the vulnerable authentication path but also breaks CLI SSO and Claude Code gateway login.

What should I rotate after patching?

The LiteLLM master key first, then every upstream provider API key the proxy holds, then the virtual keys issued to teams and applications. Both the critical and the high severity issue can disclose the master key and provider keys.

Is there a CVE for these?

No. All three advisories show no known CVE, so a vulnerability scanner that matches on CVE ids will not flag them. Match on the GHSA ids or on the version ranges instead.

Does the file read issue have a workaround?

No. The advisory states there is no reliable configuration workaround on affected versions. The fix is to upgrade to 1.95.0 or later.

Sources

Read against the primary documentation rather than secondary coverage. Where a figure comes from a provider's own docs, it is quoted as published on 2026-10-02.

Related

What else is after your credentials →Keys in shipped bundles →Pre-launch security checklist →

More from Signals

OpenAI removes o1, o3-mini, o4-mini and GPT-4 Turbo on 23 October. The replacements it names run from 5.5 times the price to 97 percent less.
Eleven models and six fine tuned models go dark in four days. Here is OpenAI's own mapping, what each landing costs on a typical month of traffic, and the places where the named replacement is not the cheapest or cannot be used at all.
OpenCode says a breach hit 1.4 percent of Console users who linked an AI provider. Rotate those keys before the root cause is published.
OpenCode has confirmed the breach and has not said how it happened or what was taken. Here is what the vendor said, who is exposed, the order to work in, and how to limit the damage next time.
GitHub Actions workflow lockfiles are in public preview. Here is how to turn them on, check them in CI, and what they do not protect.
A tag can move after you reviewed it. A lockfile makes the runner use the commit you reviewed. Here is the setup, the CI check, the policy, and what a lockfile cannot tell you.
Next.js 16.4.1 and 15.5.28 fix two critical remote code execution flaws. For one of them there is no workaround.
Two of the three fixes were postponed from September. Here is what each flaw needs in order to be reachable, the one workaround that exists, and what the announcement leaves out.
A poisoned npm release that punishes you for revoking the stolen token. The order of your response is the whole defence.
Most incident guidance starts with revoking the leaked token. Here that is the trigger. What StepSecurity found, the order it recommends, and why a valid provenance attestation did not help.
Claude Haiku 5.5 costs a tenth of Haiku 4.5 per token. One token past 100,000 it costs half.
The rate card is a tenth of Haiku 4.5. The footnote is a threshold that moves the price fivefold and that a tokenizer change pushes you toward.
Gemini 4 Argon launched at $2 and $10 and goes to $4 and $20 on 1 December. Price your product on the second number.
Every tier on the pricing page doubles on the same date. What changes, what the number includes, and what to do if you are building on the launch rate.
Claude Haiku 5.5 is not a model id swap. Five things that worked on Haiku 4.5 now return a 400.
The model id is the easy part. The requests that now fail, the response parsing that changes, and the details that fail quietly.
Next.js shipped 16.3.7 and 16.3.8 a day apart. Only one of them is the security release.
Two patch releases a day apart, one of them a decoy if you are not reading carefully. And the 15.5 line does not get the high severity fix at all.
The EU AI output marking rule is not a December deadline. For most teams it started in August.
Almost every summary of this gives one date. There are two, and which one applies to you depends on when you shipped, not on how big you are.
Sonnet 5.5 cut the rate by a third and the token count went up by about 30 percent.
A third off the per-token rate is not a third off the bill when the same text now costs more tokens. Here is the arithmetic, and the five ways your code can break.
The table your coding agent created does not have row level security on it.
Dashboard-created tables get row level security by default now. API-created tables do not, and API is how your coding agent works.
A 9.5 in next/og. Whether it reaches you depends on one line in your OG route.
The advisory rates it 9.5, but it only fires if your OG image route puts attacker-controlled text into SVG. Here is how to find out which side of that line you are on.
OpenAI and Anthropic both cut prices on 22 September. One of them costs you a refactor.
Two frontier price cuts in one day is a good week for anyone paying a token bill. The migration cost is not evenly distributed, and one of the two prices comes with an expiry hedge.
A package install reads your home directory. This week two of them did it on purpose.
The implant did nothing clever. It read the files your shell reads, in the place your credentials live, and sent them somewhere else. That is the whole attack, and it works.
GitHub is switching off SHA-1 SSH keys. Find out now whether yours is one of them.
The keys at risk are the old ones, on the machines nobody logs into, in the pipelines that have run untouched for three years. Those are also the ones that will fail loudest.
Every third-party script tag is a standing grant to run code on your visitors.
A marketing form, a chat widget, an analytics snippet. Each one is permission for someone else's server to execute whatever it sends, on every page it sits on, forever.
1.8 million Android apps were scanned for hardcoded keys. Here is how to check yours.
Finding secrets in shipped apps is now a cheap, automated pipeline. Anything compiled into an APK, an IPA or a JavaScript bundle should be treated as already published.
OpenAI's Agents API will hold your agent state. What breaks if you ever need to leave.
Two major providers moved into the agent state layer in the same week. A managed harness is a real shortcut, as long as you keep a copy of what it holds.
Meta's Muse agent can now check out at your store. What merchants should change.
Agent purchases are arriving through wallets and single-use cards, not through merchants adopting a new protocol. Many merchants will receive them without choosing to.
What Brevo's SSO incident teaches about multi-tenant SAML and hijacked sending accounts.
One incident, two lessons: why email authentication did not help, and the tenant-scoping mistake anyone shipping SSO can make.
Cloudflare now sorts bots into Search, Training and Agent. What it means for your site and your agent.
The same change lands on two audiences. Site owners can now accidentally block search; agent builders will find more doors closed.
OpenAI has announced ten dated deadlines between 23 October 2026 and 1 April 2027. Here is the calendar.
Ten dated deadlines in six months, every one announced in public. The failure mode is never the notice. Updated 19 October with the entries added since September.
Nvidia bought Hugging Face. Your open-weight fallback is now a vendor relationship.
The commitments say nothing breaks. The structural change is that "we can always self-host" is now a dependency on one vendor rather than on a neutral commons.
The Videos API goes away on 24 September and OpenAI names nothing to move to.
Every other deprecation on OpenAI's page offers a migration target. This one does not, which makes it a different kind of problem.
Whisper shuts down on 26 February. The risk is not the deadline.
Five months is a generous window. Whisper is also typically wired into a background job that fails into a queue rather than into a user's face.
The Assistants API is gone. Your app may not have told you yet.
It shut down on 26 August 2026. The replacement is not a drop-in, and the most common migration mistake changes your model's behaviour without throwing an error.
One Copilot code review costs 13 requests. Here is the rest of the maths.
Copilot now bills on usage rather than seats. The headline change is simple. The multipliers underneath it are where teams get surprised.
Row-level security is on by default now. That is not the same as being protected.
Lovable fixed the default. The gap that actually leaks data was never the default, it was the policy, and no platform can write that for you.
Your model comparison is measuring the wrong number.
Every price list is per token. Your bill is per finished piece of work. Those two numbers can rank models in opposite orders.
An agent with production log access is a new identity. Treat it like one.
Always-on agents that read production logs are arriving fast. The access-control question they raise is old and well understood, which is the good news.

Open the tool.

Ten production categories, three minutes, and a ranked list of what to fix first.

Check your own stack