AIKIDO-2026-538050

TL;DR

LiteLLM's semantic cache layer computes the tenant scope for a cache lookup with _get_semantic_cache_tenant_scope() but reads the stored cache entry's metadata key with the differently named _get_metadata_variable_name(), so a lookup can land on a cache entry written for a different tenant. An authenticated caller holding a valid virtual key can submit a semantically similar prompt on routes such as /v1/responses or /bedrock/* and receive another tenant's cached response, including personally identifiable information, financial data, or source code. A cached response carrying a function_call or tool_calls payload can also be replayed to an unrelated principal, letting an agentic front-end auto-execute attacker supplied tool calls under the victim's credentials. The fix aligns the metadata key names so a cache lookup stays scoped to the tenant that wrote it.