Description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials to that destination. Request validation in litellm/proxy/auth/auth_utils.py, litellm/proxy/common_request_processing.py, litellm/proxy/health_endpoints/_health_endpoints.py, litellm/proxy/image_endpoints/endpoints.py, and litellm/proxy/litellm_pre_call_utils.py used incomplete checks that did not cover every sensitive parameter or inspect equivalent values across nested request fields, path values, and bracket-notation form data. Routing and credential parameters including api_base, base_url, model_list, fallbacks, and litellm_credential_name could therefore be applied without clearing the operator's stored key, exposing upstream provider credentials and other configured secrets and permitting server-side requests to internal services reachable by the proxy. This issue is fixed in versions 1.88.6 and 1.96.2.
Published: 2026-09-02
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability arises from incomplete validation of request‑body routing parameters in the LiteLLM proxy. An authenticated user can supply a custom destination through parameters such as api_base or base_url, causing the server to send any stored provider credentials to that externally controlled address. This results in a server‑side request forgery that can exfiltrate credentials for upstream LLM providers and any other secrets stored in the proxy configuration. The weakness is categorized as CWE-918.

Affected Systems

Affected is BerriAI's LiteLLM proxy server, commonly named litellm. Versions older than 1.88.6 and older than 1.96.2 are vulnerable. The issue is resolved in releases 1.88.6 and 1.96.2.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity. Because the flaw requires an authenticated user, exploitation requires legitimate access to the proxy, which may be limited to internal staff. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. In practice, an attacker with legitimate credentials could redirect provider calls to a malicious host, allowing exfiltration of credentials and potential access to internal services reachable from the proxy.

Generated by OpenCVE AI on September 3, 2026 at 10:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade LiteLLM to version 1.88.6 or later 1.96.2 and maintain beyond that.
  • If a rapid upgrade is not possible, limit authentication to roles that do not modify routing parameters, and revoke privileges for setting api_base, base_url, model_list, fallbacks, and litellm_credential_name.
  • Enforce network segmentation or firewall rules to block the proxy from making outbound requests to internal or untrusted networks.

Generated by OpenCVE AI on September 3, 2026 at 10:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 03 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 03 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 03 Sep 2026 11:15:00 +0000

Type Values Removed Values Added
First Time appeared Berriai
Berriai litellm
Vendors & Products Berriai
Berriai litellm

Wed, 02 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials to that destination. Request validation in litellm/proxy/auth/auth_utils.py, litellm/proxy/common_request_processing.py, litellm/proxy/health_endpoints/_health_endpoints.py, litellm/proxy/image_endpoints/endpoints.py, and litellm/proxy/litellm_pre_call_utils.py used incomplete checks that did not cover every sensitive parameter or inspect equivalent values across nested request fields, path values, and bracket-notation form data. Routing and credential parameters including api_base, base_url, model_list, fallbacks, and litellm_credential_name could therefore be applied without clearing the operator's stored key, exposing upstream provider credentials and other configured secrets and permitting server-side requests to internal services reachable by the proxy. This issue is fixed in versions 1.88.6 and 1.96.2.
Title LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Berriai Litellm
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-03T14:31:30.548Z

Reserved: 2026-09-01T16:27:58.129Z

Link: CVE-2026-84377

cve-icon Vulnrichment

Updated: 2026-09-03T14:05:23.437Z

cve-icon NVD

Status : Received

Published: 2026-09-02T18:21:28.997

Modified: 2026-09-03T15:17:35.120

Link: CVE-2026-84377

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-02T17:18:32Z

Links: CVE-2026-84377 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T11:00:03Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)