CVE-2026-89032 BerriAI LiteLLM < 1.101.0-rc.1 Tenant Isolation Bypass via Semantic Cache Layer
Authenticated users can bypass tenant isolation in the semantic cache to read other tenants' data and trigger unauthorized tool execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-89032?
CVE-2026-89032 is a high-severity missing authorization vulnerability in BerriAI litellm, published on 25 Sep 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other tenants' cached responses by exploiting a metadata key mismatch between _get_semantic_cache_tenant_scope() and _get_metadata_variable_name(). Attackers holding a valid virtual key can submit semantically similar prompts on affected routes such as /v1/responses and /bedrock/* to retrieve cached responses containing other tenants' personally identifiable information, financial data, or source code, and can cause agentic front-ends to auto-execute attacker-supplied tool calls under victim credentials by returning cached function_call or tool_calls payloads to a different principal.
Weakness: CWE-863
Which versions are affected by CVE-2026-89032?
How do I fix CVE-2026-89032?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-89032 being exploited?
There is no known exploitation of CVE-2026-89032 in the wild and no public exploit code.
Sources
Also known as GHSA-237m-2qxv-ww7c, MINI-2c5f-pjh9-qf82, MINI-2xh9-wvgc-xrf2, MINI-4m6h-r6g6-4q42, MINI-c26q-7f7f-xgv2, MINI-cfpf-3xcf-mq5g and 7 more.