GHSA-3cv6-jpf6-8222: SSRF

Q: Who can exploit this issue?

Any authenticated LiteLLM proxy user can exploit it. The affected proxy must have configured upstream provider credentials or other secrets that the attacker can cause it to use or expose.

Q: What could an attacker do after exploiting it?

An authenticated caller can redirect an outbound provider request to an attacker-controlled destination, causing the proxy to send its configured provider credentials there. They can also use the proxy for SSRF against internal services reachable from the proxy.

Q: Are default request validation controls sufficient?

No. The vulnerable validation used a denylist that did not cover all sensitive parameters and did not inspect sensitive values nested in other request fields.

Q: What can be done if upgrading is not immediately possible?

Set general_settings.allow_client_side_credentials to false, limit proxy keys to trusted callers, and block api_base, base_url, model_list, fallbacks, and provider credential fields at a reverse proxy or API gateway.

Q: Which LiteLLM versions contain fixes?

Fixed versions are 1.96.2, 1.95.1, 1.94.3, 1.93.2, 1.92.2, 1.91.5, 1.90.7, 1.89.7, and 1.88.6.

Published Sep 30, 2026

Updated

Impact

Any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination they control and cause the proxy to send its own configured provider credentials to that destination. The proxy's request-body validation was a denylist that did not cover every sensitive parameter and did not inspect parameters nested inside other request fields, so a caller could supply a routing or credential value that the proxy applied without clearing the operator's stored key. Any authenticated user could therefore exfiltrate the operator's upstream provider credentials and other configured secrets, and perform Server-Side Request Forgery against internal services reachable from the proxy.

Patches

Fixed in 1.96.2, 1.95.1, 1.94.3, 1.93.2, 1.92.2, 1.91.5, 1.90.7, 1.89.7, and 1.88.6.

Workarounds

Set generalsettings.allowclientsidecredentials to false so callers cannot override connection parameters, restrict proxy keys to trusted callers, and block the affected parameters (apibase, baseurl, modellist, fallbacks, provider credential fields) at a reverse proxy or API gateway.

Affected Software

9 affected componentsFixes available

pip/litellm>=1.96.0<1.96.2

1.96.2

pip/litellm>=1.95.0<1.95.1

1.95.1

pip/litellm>=1.94.0<1.94.3

1.94.3

pip/litellm>=1.93.0<1.93.2

1.93.2

pip/litellm>=1.92.0<1.92.2

1.92.2

pip/litellm>=1.91.0<1.91.5

1.91.5

pip/litellm>=1.90.0<1.90.7

1.90.7

pip/litellm>=1.89.0<1.89.7

1.89.7

pip/litellm<1.88.6

1.88.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/litellm to a version that resolves this vulnerability.
Fixed in 1.96.2
Upgrade
Upgrade pip/litellm to a version that resolves this vulnerability.
Fixed in 1.95.1
Upgrade
Upgrade pip/litellm to a version that resolves this vulnerability.
Fixed in 1.94.3
Upgrade
Upgrade pip/litellm to a version that resolves this vulnerability.
Fixed in 1.93.2
Upgrade
Upgrade pip/litellm to a version that resolves this vulnerability.
Fixed in 1.92.2
Upgrade
Upgrade pip/litellm to a version that resolves this vulnerability.
Fixed in 1.91.5
Upgrade
Upgrade pip/litellm to a version that resolves this vulnerability.
Fixed in 1.90.7
Upgrade
Upgrade pip/litellm to a version that resolves this vulnerability.
Fixed in 1.89.7
Upgrade
Upgrade pip/litellm to a version that resolves this vulnerability.
Fixed in 1.88.6
Upgrade
Upgrade LiteLLM proxy to a version that resolves this vulnerability.
Fixed in 1.96.2
Upgrade
Upgrade LiteLLM proxy to a version that resolves this vulnerability.
Fixed in 1.95.1
Upgrade
Upgrade LiteLLM proxy to a version that resolves this vulnerability.
Fixed in 1.94.3
Upgrade
Upgrade LiteLLM proxy to a version that resolves this vulnerability.
Fixed in 1.93.2
Upgrade
Upgrade LiteLLM proxy to a version that resolves this vulnerability.
Fixed in 1.92.2
Upgrade
Upgrade LiteLLM proxy to a version that resolves this vulnerability.
Fixed in 1.91.5
Upgrade
Upgrade LiteLLM proxy to a version that resolves this vulnerability.
Fixed in 1.90.7
Upgrade
Upgrade LiteLLM proxy to a version that resolves this vulnerability.
Fixed in 1.89.7
Upgrade
Upgrade LiteLLM proxy to a version that resolves this vulnerability.
Fixed in 1.88.6
Configuration
Set general_settings.allow_client_side_credentials to false so callers cannot override connection parameters.
LiteLLM proxy general_settings.allow_client_side_credentials = false
Compensating control
Restrict proxy keys to trusted callers, and block api_base, base_url, model_list, fallbacks, and provider credential fields at a reverse proxy or API gateway.

Event History

Sep 30, 2026

Advisory Published

via GitHub·09:11 PM

Data Sourced

via GitHub·09:11 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who can exploit this issue?

Any authenticated LiteLLM proxy user can exploit it. The affected proxy must have configured upstream provider credentials or other secrets that the attacker can cause it to use or expose.

What could an attacker do after exploiting it?