CVE-2026-59823: LiteLLM: Server-side request forgery via the `user_config` request parameter in LiteLLM Proxy
Summary A server-side request forgery in LiteLLM Proxy lets an authenticated caller redirect the proxy's outbound request to a host of their choosing by smuggling an apibase inside the userconfig request body, bypassing the existing parameter guard.
Details LiteLLM Proxy validates request bodies with isrequestbodysafe, which blocks the apibase and baseurl parameters but does not cover userconfig. The userconfig object is used to build the outbound router for a request, so a caller can place an apibase inside it and reach an arbitrary host. The guard only inspected the two top-level keys, so the same apibase nested inside userconfig was never checked.
Exploitation requires a valid virtual key.
Impact An authenticated caller can make the proxy issue server-side requests to internal or external hosts of their choosing, reaching endpoints the caller cannot otherwise access.
Affected / Patched Affected: <= 1.83.8 Patched: 1.83.9
Remediation Upgrade to 1.83.9 or later (released 2026-04-17).
Other sources
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.9, an authenticated LiteLLM Proxy caller with a valid virtual key can place apibase inside the userconfig request body to bypass isrequestbodysafe, which blocks top-level apibase and baseurl but previously did not inspect or reject userconfig. Because userconfig constructs the outbound router, the nested destination redirects a server-side request to an internal or external host selected by the caller and can expose endpoints the caller cannot otherwise access. This issue is fixed in version 1.83.9.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/litellmto a version that resolves this vulnerability.Fixed in 1.83.9 - Upgrade
Upgrade
LiteLLM Proxyto a version that resolves this vulnerability.Fixed in 1.83.9
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated LiteLLM Proxy caller needs a valid virtual key. The caller can then supply api_base nested inside the user_config request body.
What systems are at risk from the redirected request?
The proxy can be induced to make an outbound request to an internal or external host selected by the authenticated caller. This can expose endpoints that the caller could not otherwise access.
Which versions should be remediated?
LiteLLM versions prior to 1.83.9 are affected. Upgrade to version 1.83.9, which fixes the handling of api_base within user_config.