LiteLLM semantic cache tenant isolation bypass (CVE-2026-89032)

Key facts

Detection coverage

As of 2026-11-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-6074 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: LiteLLM Semantic Cache Entry Served Across Multiple Virtual Keys (CVE-2026-89032)

Detects the CVE-2026-89032 tenant isolation failure in the LiteLLM proxy semantic cache: a single cache entry on the affected /v1/responses and /bedrock/* routes being hit by more than one virtual API key. Because the tenant scope omits end-user identity, a second key with a semantically similar prompt receives another tenant's cached response (PII, financial data, poisoned answers).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1078, T1213
• Data sources: litellm_spend_logs, litellm_proxy_logs
• Severity: high
• Confidence: high

Splunk SPL

index=litellm sourcetype="litellm:spendlogs" earliest=-24h (request_path="/v1/responses" OR request_path="/bedrock/*")
| eval cache_hit_flag=if(lower(tostring(cache_hit))="true",1,0)
```CVE-2026-89032: one cache entry reached by more than one virtual key means the tenant scope failed```
| stats count AS requests sum(cache_hit_flag) AS cache_hits dc(api_key) AS distinct_virtual_keys values(api_key) AS virtual_keys values(end_user) AS end_users values(model) AS models min(_time) AS first_seen max(_time) AS last_seen BY cache_key
| where cache_hits>0 AND distinct_virtual_keys>1
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table cache_key distinct_virtual_keys virtual_keys end_users models requests cache_hits first_seen last_seen

Microsoft KQL

LiteLLM_SpendLogs_CL
| where TimeGenerated > ago(24h)
| where request_path_s startswith "/v1/responses" or request_path_s startswith "/bedrock/"
// CVE-2026-89032: one cache entry reached by more than one virtual key means the tenant scope failed
| summarize requests = count(), cache_hits = countif(cache_hit_b == true), distinct_virtual_keys = dcount(api_key_s), virtual_keys = make_set(api_key_s, 20), end_users = make_set(end_user_s, 20), models = make_set(model_s, 10), first_seen = min(TimeGenerated), last_seen = max(TimeGenerated) by cache_key_s
| where cache_hits > 0 and distinct_virtual_keys > 1
| project cache_key_s, distinct_virtual_keys, virtual_keys, end_users, models, requests, cache_hits, first_seen, last_seen
| order by distinct_virtual_keys desc

Sigma

title: LiteLLM Semantic Cache Hit On CVE-2026-89032 Affected Route
name: litellm_semantic_cache_hit_affected_route
id: 3b1f6c1e-8a42-4d6a-9c11-6074a0000001
status: experimental
description: Detects a LiteLLM semantic cache hit on the /v1/responses or /bedrock/* routes affected by CVE-2026-89032. Pair with the included correlation rule to flag a single cache entry served to two or more virtual keys.
references:
    - https://blog.nviso.eu/2026/11/12/breaking-the-semantic-cache-a-litellm-case-study-cve-2026-89032/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-89032
    - https://www.vulncheck.com/advisories/berriai-litellm-rc-1-tenant-isolation-bypass-via-semantic-cache-layer
author: Threadlinqs Team
date: 2026-11-14
tags:
    - attack.initial-access
    - attack.t1190
    - attack.t1078
    - attack.collection
    - attack.t1213
    - cve.2026.89032
logsource:
    product: litellm
    service: spend_logs
detection:
    selection_route:
        request_path|startswith:
            - '/v1/responses'
            - '/bedrock/'
    selection_hit:
        cache_hit: true
    condition: selection_route and selection_hit
falsepositives:
    - Same virtual key retrying an identical prompt (single-key cache reuse)
    - Shared service key intentionally used by one team
level: medium
---
title: LiteLLM Shared Semantic Cache Entry Served To Multiple Virtual Keys
id: 3b1f6c1e-8a42-4d6a-9c11-6074a0000011
status: experimental
description: Correlates cache hits on CVE-2026-89032 affected routes where one cache entry is served to two or more distinct virtual API keys within 24 hours.
author: Threadlinqs Team
date: 2026-11-14
tags:
    - attack.initial-access
    - attack.t1190
    - attack.collection
    - attack.t1213
    - cve.2026.89032
correlation:
    type: value_count
    rules:
        - litellm_semantic_cache_hit_affected_route
    group-by:
        - cache_key
    timespan: 24h
    condition:
        gte: 2
        field: api_key
level: high

Known false positives:

• Several engineers sharing one service virtual key that is intentionally scoped to a single team
• Load-balanced health-check or synthetic monitoring prompts issued with different keys against the same cache entry

Tuning notes: Field names (request_path, cache_key, api_key, end_user, cache_hit) follow the LiteLLM_SpendLogs schema; remap to your ingestion. Allow-list known shared service keys. Hits only appear when similarity_threshold is permissive, so raise severity when cache_params.similarity_threshold is below 0.5. After upgrading to v1.101.0-rc.1 and enabling cache_params.semantic_cache_scope: end_user, this should return zero rows.

• 🔒 [indicator] Virtual Key Probing Semantic Cache For Other Tenants' Responses · unlock with TL Creds
• 🔒 [indicator] Cache-Hit Response Containing PII Served On Affected Routes · unlock with TL Creds
• 🔒 Direct Redis Semantic Cache Access or Tampering Outside the [indicator] Proxy · unlock with TL Creds
• 🔒 [indicator] Poisoning PoC Artifacts: Attacker Account, Fabricated Promo Code, Mock Bank Tool · unlock with TL Creds
• 🔒 Vulnerable [indicator] Semantic Cache Configuration (redis-semantic Without end_user Scope) · unlock with TL Creds
• 🔒 [indicator] Request With MCP Tool require_approval never on Affected Route · unlock with TL Creds
• 🔒 [indicator] Cached Tool Call Served From Semantic Cache (Tool-Call Poisoning) · unlock with TL Creds
• 🔒 Coding Agent Spawning Shell With Download or Reverse-Shell Command (Cached Bash Tool-Call Poisoning) · unlock with TL Creds

Indicators of compromise

As of 2026-11-14, Threadlinqs Intelligence tracks 5 indicators of compromise for TL-2026-6074.

Sample indicators (1 of 5)

• File hash: 16db51e2cfc28e02bd460481e634a8403ea9265e

Defanged, TLP:CLEAR. Full set of 5 indicators: unlock with TL Creds.

Technical analysis

CVE-2026-89032 affects BerriAI LiteLLM before 1.101.0-rc.1. Per the VulnCheck CNA record, the root cause is a metadata key mismatch between _get_semantic_cache_tenant_scope() and _get_metadata_variable_name(). Because of it, the tenant scope key used by the semantic cache does not include the end-user identity by default. An authenticated user holding a valid virtual key can submit semantically similar prompts to affected routes (/v1/responses and /bedrock/*) and receive responses cached for other tenants. These can contain PII, financial data or source code.

NVISO found the flaw during an independent code review and published a write-up on 2026-11-12. The lab setup used LiteLLM v1.99.0 with cache type redis-semantic (Redis backend, PostgreSQL for the LiteLLM database), an Azure text-embedding-3-large embedding model, and a deliberately low similarity_threshold of 0.2. NVISO notes that production thresholds of 0.85-0.95 make exploitation harder, although the isolation failure itself remains.

NVISO demonstrated three impacts. (1) PII leakage: a victim's support-ticket prompt containing name, email, phone, date of birth, partial SSN, account number and address was cached. A second key's vaguely similar prompt about a missing paycheck returned the victim's data. (2) Hallucination poisoning: an attacker with a system prompt discouraging 'I do not know' answers asked about a non-existent PS5 Pro flash sale. The model invented a price and promo code, and a later user asking a similar question received the cached fabricated answer. (3) Tool-call poisoning: using a mock bank MCP server exposing send_transaction, an attacker-cached tool call (a transfer to an attacker account) was served to a victim whose request was semantically similar, and it executed. NVISO also describes how a cached bash tool call served to a coding agent could lead to arbitrary command execution, but does not show a full PoC for it.

The vendor fix adds an opt-in cache_params.semantic_cache_scope: end_user setting (PR 39590, commit 16db51e2). Disclosure timeline per NVISO: reported via GitHub security advisory on 2026-06-28, report closed 2026-08-04, handed to VulnCheck 2026-08-28, patch released 2026-09-04, CVE assigned 2026-09-25. No in-the-wild exploitation is reported, the CVE is not in CISA KEV, and the CISA ADP SSVC entry lists Exploitation: none. No threat actor is attributed.

MITRE ATT&CK / ATLAS techniques by tactic:

Execution

AML.T0053 AI Agent Tool Invocation; T1059 Command and Scripting Interpreter

Exfiltration

AML.T0057 LLM Data Leakage

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Collection

T1213 Data from Information Repositories

Impact

T1565.001 Stored Data Manipulation; T1657 Financial Theft

Remediation

Patches

• LiteLLM v1.101.0-rc.1 (PR 39590, commit 16db51e2cfc28e02bd460481e634a8403ea9265e)

Immediate actions

• Upgrade LiteLLM to v1.101.0-rc.1 or later
• Disable the semantic cache on multi-tenant deployments until patched
• Review spend logs and cache contents for cross-tenant hits on /v1/responses and /bedrock/* routes

Workarounds

• Turn off cache / redis-semantic cache type
• Require human approval for MCP tool calls rather than require_approval: never

Longer-term hardening

• Enable cache_params.semantic_cache_scope: end_user so cache buckets are isolated per user
• Raise similarity_threshold to typical production values (0.85-0.95)
• Never cache tool_calls or function_call responses
• Scan responses for PII and do not cache responses containing it
• Avoid semantic caching entirely where isolation or tuning cannot be guaranteed

Affected and fixed versions

• BerriAI — LiteLLM
  Vulnerable versions: < 1.101.0-rc.1 (PoCs demonstrated on 1.99.0)
  Fixed in: 1.101.0-rc.1

Timeline

• 2026-06-28 NVISO reports the flaw to LiteLLM via a GitHub security advisory.
• 2026-07-23 NVISO follows up with LiteLLM support.
• 2026-08-04 The GitHub security report is closed.
• 2026-08-28 NVISO hands the report to VulnCheck.
• 2026-09-04 LiteLLM releases the fix in v1.101.0-rc.1 (PR 39590), adding an opt-in end_user semantic cache scope.
• 2026-09-25 VulnCheck assigns and publishes CVE-2026-89032 (CVSS v4.0 8.7, CWE-863); NVD entry published the same day.
• 2026-11-12 NVISO publishes 'Breaking the Semantic Cache' with PII leakage, hallucination poisoning and tool-call poisoning PoCs against LiteLLM v1.99.0.

Sources cited

• VulnCheck Advisory: BerriAI LiteLLM Tenant Isolation Bypass via Semantic Cache Layer vulncheck.com · Advisory · 2026-09-25
• NVD: CVE-2026-89032 NVD (NIST) · Advisory · 2026-09-25
• OpenCVE: CVE-2026-89032 app.opencve.io · Advisory · 2026-09-25
• CVE Record CVE-2026-89032 CVE Program · Advisory · 2026-09-25
• Breaking the Semantic Cache: A LiteLLM Case Study (CVE-2026-89032) blog.nviso.eu · Research · 2026-11-12
• Red Hat Bugzilla 2541509 bugzilla.redhat.com · Vendor report · 2026-09-25
• LiteLLM release v1.101.0-rc.1 GitHub · Code repository · 2026-09-04
• LiteLLM pull request 39590 (fix) GitHub · Code repository · 2026-09-04
• LiteLLM patch commit 16db51e2 GitHub · Code repository · 2026-09-04

More in vulnerability

• FreeRDP client-side RCE chain (CVE-2026-91964 heap overflow + CVE-2026-91963 USB redirection heap disclosure) found via AI-agent vulnerability research workflow
• Ivanti EPM Core Critical SQL Injection Enabling Unauthenticated RCE (CVE-2026-121653) and Multiple Ivanti CSA/EPMM/Sentry/UWM Flaws
• UnrealIRCd labeled-response IRCv3 label tag injection (CVE-2026-114713) exploited in the wild
• PTC Windchill and FlexPLM Critical RCE via Deserialization of Untrusted Data (CVE-2026-126325)
• CISA adds Check Point Gaia DynamicCLI LPE (CVE-2026-123039) and UnrealIRCd labeled-response command injection (CVE-2026-114713) to KEV