CVE-2026-84377: LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters
Impact
Any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination they control and cause the proxy to send its own configured provider credentials to that destination. The proxy's request-body validation was a denylist that did not cover every sensitive parameter and did not inspect parameters nested inside other request fields, so a caller could supply a routing or credential value that the proxy applied without clearing the operator's stored key. Any authenticated user could therefore exfiltrate the operator's upstream provider credentials and other configured secrets, and perform Server-Side Request Forgery against internal services reachable from the proxy.
Patches
Fixed in 1.96.2, 1.95.1, 1.94.3, 1.93.2, 1.92.2, 1.91.5, 1.90.7, 1.89.7, and 1.88.6.
Workarounds
Set generalsettings.allowclientsidecredentials to false so callers cannot override connection parameters, restrict proxy keys to trusted callers, and block the affected parameters (apibase, baseurl, modellist, fallbacks, provider credential fields) at a reverse proxy or API gateway.
Other sources
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials to that destination. Request validation in litellm/proxy/auth/authutils.py, litellm/proxy/commonrequestprocessing.py, litellm/proxy/healthendpoints/healthendpoints.py, litellm/proxy/imageendpoints/endpoints.py, and litellm/proxy/litellmprecallutils.py used incomplete checks that did not cover every sensitive parameter or inspect equivalent values across nested request fields, path values, and bracket-notation form data. Routing and credential parameters including apibase, baseurl, modellist, fallbacks, and litellmcredentialname could therefore be applied without clearing the operator's stored key, exposing upstream provider credentials and other configured secrets and permitting server-side requests to internal services reachable by the proxy. This issue is fixed in versions 1.88.6 and 1.96.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/litellmto a version that resolves this vulnerability.Fixed in 1.96.2 - Upgrade
Upgrade
pip/litellmto a version that resolves this vulnerability.Fixed in 1.95.1 - Upgrade
Upgrade
pip/litellmto a version that resolves this vulnerability.Fixed in 1.94.3 - Upgrade
Upgrade
pip/litellmto a version that resolves this vulnerability.Fixed in 1.93.2 - Upgrade
Upgrade
pip/litellmto a version that resolves this vulnerability.Fixed in 1.92.2 - Upgrade
Upgrade
pip/litellmto a version that resolves this vulnerability.Fixed in 1.91.5 - Upgrade
Upgrade
pip/litellmto a version that resolves this vulnerability.Fixed in 1.90.7 - Upgrade
Upgrade
pip/litellmto a version that resolves this vulnerability.Fixed in 1.89.7 - Upgrade
Upgrade
pip/litellmto a version that resolves this vulnerability.Fixed in 1.88.6 - Upgrade
Upgrade
LiteLLMto a version that resolves this vulnerability.Fixed in 1.96.2 - Upgrade
Upgrade
LiteLLMto a version that resolves this vulnerability.Fixed in 1.95.1 - Upgrade
Upgrade
LiteLLMto a version that resolves this vulnerability.Fixed in 1.94.3 - Upgrade
Upgrade
LiteLLMto a version that resolves this vulnerability.Fixed in 1.93.2 - Upgrade
Upgrade
LiteLLMto a version that resolves this vulnerability.Fixed in 1.92.2 - Upgrade
Upgrade
LiteLLMto a version that resolves this vulnerability.Fixed in 1.91.5 - Upgrade
Upgrade
LiteLLMto a version that resolves this vulnerability.Fixed in 1.90.7 - Upgrade
Upgrade
LiteLLMto a version that resolves this vulnerability.Fixed in 1.89.7 - Upgrade
Upgrade
LiteLLMto a version that resolves this vulnerability.Fixed in 1.88.6 - Configuration
Set general_settings.allow_client_side_credentials to false so callers cannot override connection parameters.
LiteLLM proxy general_settings.allow_client_side_credentials = false - Compensating control
Restrict proxy keys to trusted callers, and at a reverse proxy or API gateway block client-supplied api_base, base_url, model_list, fallbacks, and provider credential fields.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated LiteLLM proxy user can exploit it. No user interaction is required, and the attacker can direct the proxy to destinations they control or to internal services reachable from the proxy.
What information or access could an attacker obtain?
The proxy can send configured upstream provider credentials and other configured secrets to an attacker-controlled destination. The issue also permits server-side requests to internal services that the LiteLLM proxy can reach.
Which request inputs are involved?
Affected routing and credential-related inputs include api_base, base_url, model_list, fallbacks, and litellm_credential_name. The incomplete validation also failed to consistently inspect equivalent values in nested request fields, path values, and bracket-notation form data.
What versions contain the fix?
The issue is fixed in LiteLLM versions 1.88.6 and 1.96.2. Deploy one of these fixed versions or a later applicable release.