Vulnerability · Published Sep 2, 2026 · Assigned by GitHub_M
CVE-2026-84377LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters
Medium 6.5
In plain English
A medium-severity server-side request forgery in litellm from BerriAI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials to that destination. Request validation in litellm/proxy/auth/auth_utils.py, litellm/proxy/common_request_processing.py, litellm/proxy/health_endpoints/_health_endpoints.py, litellm/proxy/image_endpoints/endpoints.py, and litellm/proxy/litellm_pre_call_utils.py used incomplete checks that did not cover every sensitive parameter or inspect equivalent values across nested request fields, path values, and bracket-notation form data. Routing and credential parameters including api_base, base_url, model_list, fallbacks, and litellm_credential_name could therefore be applied without clearing the operator's stored key, exposing upstream provider credentials and other configured secrets and permitting server-side requests to internal services reachable by the proxy. This issue is fixed in versions 1.88.6 and 1.96.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | litellm | 1.88.6 | GHSA-3cv6-jpf6-8222 |
| PyPI | litellm | 1.89.7 | GHSA-3cv6-jpf6-8222 |
| PyPI | litellm | 1.90.7 | GHSA-3cv6-jpf6-8222 |
| PyPI | litellm | 1.91.5 | GHSA-3cv6-jpf6-8222 |
| PyPI | litellm | 1.92.2 | GHSA-3cv6-jpf6-8222 |
| PyPI | litellm | 1.93.2 | GHSA-3cv6-jpf6-8222 |
| PyPI | litellm | 1.94.3 | GHSA-3cv6-jpf6-8222 |
| PyPI | litellm | 1.95.1 | GHSA-3cv6-jpf6-8222 |
| PyPI | litellm | 1.96.2 | GHSA-3cv6-jpf6-8222 |
| PyPI | litellm | 1.88.6, 1.89.7, 1.90.7, 1.91.5, 1.92.2, 1.93.2, 1.94.3, 1.95.1, 1.96.2 | PYSEC-2026-4066 |
Affected products (as reported)
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/BerriAI/litellm/security/advisories/GHSA-3cv6-jpf6-8222 x_refsource_CONFIRM
- https://github.com/BerriAI/litellm/pull/36011 x_refsource_MISC
- https://github.com/BerriAI/litellm/pull/36314 x_refsource_MISC
- https://github.com/BerriAI/litellm/pull/36494 x_refsource_MISC
- https://github.com/BerriAI/litellm/commit/473f72e63a9777d793fbbf57194d8ec4fb97bc1b x_refsource_MISC
- https://github.com/BerriAI/litellm/commit/820f247a6abba55cd87d130bef7bba7be3b29d37 x_refsource_MISC
- https://github.com/BerriAI/litellm/commit/c898d341c02299cf2506d0d8e84cc67953043593 x_refsource_MISC
- https://github.com/BerriAI/litellm/releases/tag/v1.88.6 x_refsource_MISC
- https://github.com/BerriAI/litellm/releases/tag/v1.96.2 x_refsource_MISC