Threat video1:00
CVE-2026-89032 LiteLLM Cache Tenant Leak: Detection & IOCs
Virtual-key holders can read other tenants' cached LiteLLM replies and tool calls. Track it with 9 detection rules, 5 IOCs and a free Splunk SPL rule.
Read the full threat intel for CVE-2026-89032 LiteLLM Cache Tenant Leak: Detection & IOCs →
Chapters
- 0:00The hookLiteLLM's cache let tenants read each other's answers.
- 0:05The storyFound in an independent code review.
- 0:11Attack pathA valid virtual key could read other tenants' cached answers.
- 0:26AttributionNo threat actor is attributed.
- 0:31Indicators of compromise3 indicators to hunt: 1 hash, 1 package name and 1 path.
- 0:37MITRE ATT&CK techniques6 ATT&CK techniques, from initial access to impact.
- 0:42Remediation11 remediation steps are listed, 3 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00LiteLLM's cache let tenants read each other's answers.
0:05Found in an independent code review.
0:07Fixed by the vendor in September.
0:12A valid virtual key could read other tenants' cached answers.
0:15Those answers can hold PII or source code.
0:19In a lab, fake answers and a transfer reached victims.
0:26No threat actor is attributed. Confidence: low.
0:313 indicators to hunt: 1 hash, 1 package name and 1 path.
0:376 ATT&CK techniques, from initial access to impact.
0:4211 remediation steps are listed, 3 of them immediate.
0:509 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.