GHSA-hx8v-g79f-8w5f: SSRF
Summary A server-side request forgery in LiteLLM Proxy lets an authenticated caller redirect the proxy's outbound request to a host of their choosing by smuggling an apibase inside the userconfig request body, bypassing the existing parameter guard.
Details LiteLLM Proxy validates request bodies with isrequestbodysafe, which blocks the apibase and baseurl parameters but does not cover userconfig. The userconfig object is used to build the outbound router for a request, so a caller can place an apibase inside it and reach an arbitrary host. The guard only inspected the two top-level keys, so the same apibase nested inside userconfig was never checked.
Exploitation requires a valid virtual key.
Impact An authenticated caller can make the proxy issue server-side requests to internal or external hosts of their choosing, reaching endpoints the caller cannot otherwise access.
Affected / Patched Affected: <= 1.83.8 Patched: 1.83.9
Remediation Upgrade to 1.83.9 or later (released 2026-04-17).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/litellmto a version that resolves this vulnerability.Fixed in 1.83.9 - Upgrade
Upgrade
LiteLLM Proxyto a version that resolves this vulnerability.Fixed in 1.83.9
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires a valid LiteLLM Proxy virtual key. An unauthenticated caller is not described as being able to trigger it.
Are default request-body protections sufficient?
No. The existing guard blocks top-level api_base and base_url fields, but it does not inspect api_base when it is nested inside user_config.
What systems could an attacker reach through the proxy?
An authenticated caller can direct the proxy to make outbound requests to internal or external hosts of their choosing, including endpoints the caller could not otherwise access.
Which versions need to be remediated?
LiteLLM versions 1.83.8 and earlier are affected. Upgrade to version 1.83.9 or later.