CVE-2026-84377: LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials to that destination. Request validation in litellm/proxy/auth/authutils.py, litellm/proxy/commonrequestprocessing.py, litellm/proxy/healthendpoints/healthendpoints.py, litellm/proxy/imageendpoints/endpoints.py, and litellm/proxy/litellmprecallutils.py used incomplete checks that did not cover every sensitive parameter or inspect equivalent values across nested request fields, path values, and bracket-notation form data. Routing and credential parameters including apibase, baseurl, modellist, fallbacks, and litellmcredentialname could therefore be applied without clearing the operator's stored key, exposing upstream provider credentials and other configured secrets and permitting server-side requests to internal services reachable by the proxy. This issue is fixed in versions 1.88.6 and 1.96.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.88.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.96.2
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated LiteLLM proxy user can exploit it. No user interaction is required, and the attacker can direct the proxy to destinations they control or to internal services reachable from the proxy.
What information or access could an attacker obtain?
The proxy can send configured upstream provider credentials and other configured secrets to an attacker-controlled destination. The issue also permits server-side requests to internal services that the LiteLLM proxy can reach.
Which request inputs are involved?
Affected routing and credential-related inputs include api_base, base_url, model_list, fallbacks, and litellm_credential_name. The incomplete validation also failed to consistently inspect equivalent values in nested request fields, path values, and bracket-notation form data.
What versions contain the fix?
The issue is fixed in LiteLLM versions 1.88.6 and 1.96.2. Deploy one of these fixed versions or a later applicable release.