CVE-2026-89032 is a high-severity vulnerability affecting BerriAI LiteLLM prior to version 1.101.0-rc.1. The flaw arises from a mismatch between the functions _get_semantic_cache_tenant_scope() and _get_metadata_variable_name() in the semantic cache layer, which leads to tenant isolation bypass. Authenticated attackers holding a valid virtual key can submit semantically similar prompts to affected API routes (e.g., /v1/responses and /bedrock/*) to retrieve cached responses from other tenants. These responses may contain sensitive information such as personally identifiable information, financial data, or source code. Furthermore, the vulnerability can cause agentic front-ends to automatically execute attacker-supplied tool calls under the victim's credentials by returning cached function_call or tool_calls payloads to a different principal.

Exploitation allows authenticated users to bypass tenant isolation and access cached data belonging to other tenants, potentially exposing sensitive personal, financial, or proprietary information. It also enables attackers to trigger automatic execution of tool calls under victim credentials, increasing the risk of unauthorized actions within the affected environment.

A fix is available in BerriAI LiteLLM version 1.101.0-rc.1 and later. Users should upgrade to this version or newer to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying the vendor's patch. Patch status is confirmed by the affectedVersions field indicating versions before 1.101.0-rc.1 are vulnerable.