BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other tenants' cached responses by exploiting a metadata key mismatch between _get_semantic_cache_tenant_scope() and _get_metadata_variable_name(). Attackers holding a valid virtual key can submit semantically similar prompts on affected routes such as /v1/responses and /bedrock/* to retrieve cached responses containing other tenants' personally identifiable information, financial data, or source code, and can cause agentic front-ends to auto-execute attacker-supplied tool calls under victim credentials by returning cached function_call or tool_calls payloads to a different principal.
{
"cna_assigner": "VulnCheck",
"cwe_ids": [
"CWE-863"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89032.json"
}{
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "1.101.0-rc.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"original_tag": "v1.101.0-rc.1",
"range": [
{
"fixed": "eeb7732fc11fd47762ca84cc3fb7cc74235d7097"
}
],
"source": "REFERENCES_TAG"
},
{
"range": [
{
"fixed": "16db51e2cfc28e02bd460481e634a8403ea9265e"
}
],
"source": "REFERENCES_COMMIT"
}
]
}