CVE-2026-89032 BerriAI CVE debrief

Who should care

Defenders responsible for systems using BerriAI LiteLLM, especially those with multi-tenant environments, should assess exposure and verify the version of LiteLLM in use. Security teams handling sensitive data or agentic front-ends should prioritize verification and remediation efforts.

Why it matters

CVE-2026-89032 is a high-severity vulnerability in BerriAI LiteLLM that allows authenticated users to bypass tenant isolation and access cached responses from other tenants. Defenders should prioritize verifying exposure, especially for systems using LiteLLM versions prior to 1.101.0-rc.1, and assess the effectiveness of current tenant isolation controls.

• Potential unauthorized access to sensitive data
• Possible auto-execution of attacker-supplied tool calls under victim credentials
• Need for verification of tenant isolation controls
• Requirement for updating to version 1.101.0-rc.1 or later

Technical summary

The vulnerability exists in the semantic cache layer of BerriAI LiteLLM, allowing authenticated users with a valid virtual key to submit semantically similar prompts and retrieve cached responses from other tenants. This can lead to unauthorized access to personally identifiable information, financial data, or source code. The vulnerability is caused by a metadata key mismatch between _get_semantic_cache_tenant_scope() and _get_metadata_variable_name(). Attackers can exploit this vulnerability to bypass tenant isolation and access sensitive data from other tenants.

Defensive priority

Defenders should prioritize verifying exposure, especially for systems using LiteLLM versions prior to 1.101.0-rc.1, and assess the effectiveness of current tenant isolation controls.

Recommended defensive actions

• Verify the version of LiteLLM in use and assess exposure
• Review and update tenant isolation controls
• Monitor for suspicious activity on affected routes
• Consider compensating controls for sensitive data
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the corpus lacks specific information on exploitation, impact, or remediation beyond version 1.101.0-rc.1.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.