BerriAI litellm before 1.101.0-rc.1 has a semantic cache tenant isolation bypass due to a metadata key mismatch between _get_semantic_cache_tenant_scope() and _get_metadata_variable_name(). Authenticated users with a valid virtual key can send semantically similar prompts to /v1/responses or /bedrock/* to read other tenants’ cached PII/financial data/source code and replay cached function_call/tool_calls under victim creds. Upgrade to >=1.101.0-rc.1 to mitigate.