CVE-2026-89032

Awaiting Analysis Awaiting Analysis - Queue

Tenant Isolation Bypass in BerriAI LiteLLM

Publication date: 2026-09-25

Last updated on: 2026-10-01

Assigner: VulnCheck

Description

BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other tenants' cached responses by exploiting a metadata key mismatch between _get_semantic_cache_tenant_scope() and _get_metadata_variable_name(). Attackers holding a valid virtual key can submit semantically similar prompts on affected routes such as /v1/responses and /bedrock/* to retrieve cached responses containing other tenants' personally identifiable information, financial data, or source code, and can cause agentic front-ends to auto-execute attacker-supplied tool calls under victim credentials by returning cached function_call or tool_calls payloads to a different principal.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-01

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-89032

EUVD

EUVD-2026-87147

Affected Vendors & Products

Vendor	Product	Version / Range
berri_ai	litellm	to 1.101.0-rc.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

BerriAI LiteLLM before version 1.101.0-rc.1 has a tenant isolation bypass flaw in its semantic cache layer. This allows authenticated users to access other tenants' cached responses by exploiting a mismatch in metadata keys between two functions. Attackers with a valid virtual key can submit similar prompts to retrieve cached data containing sensitive information like PII, financial data, or source code.

Detection Guidance

This vulnerability involves a tenant isolation bypass in BerriAI LiteLLM versions before 1.101.0-rc.1. Detection requires checking the LiteLLM version and monitoring for unauthorized access to cached responses. No specific commands are provided in the context to directly detect this issue.

Impact Analysis

If you are a user of BerriAI LiteLLM, an attacker could access your cached responses containing sensitive data. This could lead to exposure of personally identifiable information, financial data, or proprietary source code. Additionally, cached function calls or tool payloads might be returned under your credentials, potentially allowing unauthorized actions.

Compliance Impact

This vulnerability could lead to unauthorized access to protected health information or personally identifiable data, violating GDPR and HIPAA compliance. Organizations using affected versions may face legal penalties, data breach notifications, and reputational damage due to non-compliance with data protection regulations.

Mitigation Strategies

Immediately upgrade BerriAI LiteLLM to version 1.101.0-rc.1 or later to patch the tenant isolation bypass vulnerability in the semantic cache layer.

Hi! I’m here to help you understand CVE-2026-89032. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70