A flaw in BerriAI LiteLLM’s semantic cache layer allows an authenticated user to read other tenants’ cached responses by exploiting a mismatch between internal cache functions that retrieve metadata. The vulnerability can expose personally identifiable information, financial data, source code, and can trick agents into executing tool calls on a victim’s behalf by returning cached function_call or tool_calls payloads to a different principal. The weakness stems from insufficient authorization checks involving tenant scope and metadata variable names (CWE‑863 and CWE‑524).

The issue affects all releases of BerriAI LiteLLM before version 1.101.0‑rc.1. All routes such as /v1/responses and /bedrock/* that expose the semantic cache are potentially exploitable and should be examined for this product version.

The CVSS score of 8.7 classifies the flaw as high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with a valid virtual key to submit semantically similar prompts on the affected endpoints; success results in cross‑tenant data leakage and possible privilege escalation through auto‑executed tool calls.