CVE-2026-89032
published 2026-09-25CVE-2026-89032: BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other…
PriorityP343high7.7CVSS 3.1
AVNACHPRLUIRSCCHIHAN
EPSS
0.27%
18.6th percentile
BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other tenants' cached responses by exploiting a metadata key mismatch between _get_semantic_cache_tenant_scope() and _get_metadata_variable_name(). Attackers holding a valid virtual key can submit semantically similar prompts on affected routes such as /v1/responses and /bedrock/* to retrieve cached responses containing other tenants' personally identifiable information, financial data, or source code, and can cause agentic front-ends to auto-execute attacker-supplied tool calls under victim credentials by returning cached function_call or tool_calls payloads to a different principal.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| berriai | litellm | < 1.101.0-rc.1 | 1.101.0-rc.1 |
| lightspeed-core | lightspeed-stack-rhel9 | — | — |
| rhoai | odh-llama-stack-core-rhel9 | — | — |
| rhoai | odh-mlflow-rhel9 | — | — |
| rhoai | odh-th-torch-cpu-py312-rhel9 | — | — |
| rhoai | odh-th-torch-cuda-py312-rhel9 | — | — |
| rhoai | odh-trustyai-garak-lls-provider-dsp-rhel9 | — | — |
CVSS provenance
nvdv3.17.7HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other tenants' cached responses by exploiting a
ghsa_unreviewed·2026-09-25
CVE-2026-89032 [HIGH] CWE-863 BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other tenants' cached responses by exploiting a
BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other tenants' cached responses by exploiting a metadata key mismatch between _get_semantic_cache_tenant_scope() and _get_metadata_variable_name(). Attackers holding a valid virtual key can submit semantically similar prompts on affected routes such as /v1/responses and /bedrock/* to retrieve cached responses containing other tenants' personally identifiable information, financial data, or source code, and can cause agentic front-ends to auto-execute attacker-supplied tool calls under victim credentials by returning cached function_call or tool_calls payloads to a different principal.
Red Hat
litellm: LiteLLM: Information disclosure via semantic cache metadata mismatch
vendor_redhat·2026-09-25·CVSS 7.7
CVE-2026-89032 [HIGH] CWE-524 litellm: LiteLLM: Information disclosure via semantic cache metadata mismatch
litellm: LiteLLM: Information disclosure via semantic cache metadata mismatch
A flaw was found in LiteLLM. Due to a metadata key mismatch in the semantic cache component, an authenticated remote attacker can bypass tenant isolation by submitting semantically similar queries. This issue leads to information disclosure, allowing unauthorized access to cached responses containing other tenants' sensitive data, and may cause connected automated agents to execute unauthorized actions under victim credentials.
Package: lightspeed-core/lightspeed-stack-rhel9 (Lightspeed Core) - Affected
Package: ansible-automation-platform-26/lightspeed-chatbot-rhel9 (Red Hat Ansible Automation Platform 2) - Affected
Package: ansible-automation-platform-27/lightspeed-chatbot-rhel9 (Red Hat Ansible Automation
No detection rules found.
No public exploits indexed.
2026-09-25
Published