LiteLLM CVE-2026-89032

Requires a multi-tenant LiteLLM deployment (before 1.101.0-rc.1) with the semantic cache layer enabled and the attacker possessing a valid virtual key (authenticated, PR:L). Exploitation targets specific routes such as /v1/responses and /bedrock/* and depends on the metadata-key mismatch between _get_semantic_cache_tenant_scope() and _get_metadata_variable_name(); the attacker must craft prompts semantically similar enough to collide with a victim tenant's cached entries (AC:H). The tool-call abuse path additionally requires an agentic front-end that auto-executes returned function_call/tool_calls payloads (UI:P). Limiting factors: single-tenant installs, deployments with semantic caching disabled, and non-agentic clients substantially reduce or eliminate impact.

This is a genuine, well-substantiated authorization flaw (CWE-863) reported by VulnCheck with a vendor patch already available (commit 16db51e2, PR #39590, fixed in v1.101.0-rc.1), so the underlying defect is confirmed rather than speculative. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N, base 8.7 High) tells a coherent story: network-reachable, but requiring a valid virtual key (PR:L - authenticated), elevated attack complexity (AC:H, because exploitation depends on crafting semantically similar prompts that collide with another tenant's cache entry), and passive user interaction (UI:P). The high confidentiality and integrity impacts plus scope-change metrics (SC:H/SI:H) are justified because the flaw crosses a tenant/security boundary - one principal reads another principal's data and can influence another principal's tool execution. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation is not confirmed in the wild; the AC:H and PR:L requirements argue against opportunistic mass exploitation and toward targeted abuse by an existing authenticated tenant. Net: this is a real priority for multi-tenant LiteLLM deployments (especially those exposing semantic caching and agentic tool-calling), but the authenticated + high-complexity gating keeps it below drop-everything status for single-tenant or cache-disabled installs.

An authenticated user holding a valid LiteLLM virtual key on a multi-tenant gateway submits prompts that are semantically similar to another tenant's earlier requests against affected routes such as /v1/responses or /bedrock/*, causing the semantic cache to return the other tenant's cached response containing PII, financial data, or source code. In an agentic setup, the attacker can further coerce a victim front-end into auto-executing attacker-influenced function_call/tool_calls payloads under the victim's credentials. No public exploit code was identified at time of analysis, but the flaw is confirmed and patched by the vendor.