Tenant Isolation Bypass in BerriAI LiteLLM Semantic Cache

BerriAI LiteLLM versions before 1.101.0-rc.1 contain a tenant isolation bypass vulnerability located within the semantic cache layer. The flaw arises from a mismatch between the functions _get_semantic_cache_tenant_scope() and _get_metadata_variable_name(), which manage the scoping of cache entries. An attacker with a valid virtual key can exploit this logical error by submitting specifically crafted prompts.

By targeting routes such as /v1/responses or /bedrock/*, an authenticated user can retrieve cached responses belonging to other tenants. This unauthorized access can lead to the exposure of sensitive information, including personally identifiable information (PII), financial data, and proprietary source code. Furthermore, the vulnerability enables attackers to manipulate agentic front-ends by injecting malicious payloads into the cache; when retrieved by a different principal, these cached function_call or tool_calls payloads may trigger unintended tool execution under the victim's credentials.

Impact

The vulnerability results in a loss of data confidentiality and integrity for multi-tenant environments using LiteLLM. Successful exploitation allows unauthorized access to sensitive tenant data and the potential for privilege escalation or remote code execution within agentic workflows through tool call manipulation.

Recommendation

• Upgrade BerriAI LiteLLM to version 1.101.0-rc.1 or later immediately to resolve the metadata key mismatch in the semantic cache layer.
• Implement strict access controls and audit logging for sensitive endpoints including /v1/responses and routes under /bedrock/*.
• Review cached entries for unexpected or anomalous function_call parameters if suspicion of exploitation arises.