GHSA-3cv6-jpf6-8222 CVE-2026-84377 PYSEC-2026-4066
LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters
- Severity
- 6.5 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.54%
- Chance of exploitation in the next 30 days. Higher than 45.43% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-918 Server-Side Request Forgery (SSRF)
- Fix
1.88.6- Upgrade litellm to this version or later
Description
Impact
Any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination they control and cause the proxy to send its own configured provider credentials to that destination. The proxy's request-body validation was a denylist that did not cover every sensitive parameter and did not inspect parameters nested inside other request fields, so a caller could supply a routing or credential value that the proxy applied without clearing the operator's stored key. Any authenticated user could therefore exfiltrate the operator's upstream provider credentials and other configured secrets, and perform Server-Side Request Forgery against internal services reachable from the proxy.
Patches
Fixed in 1.96.2, 1.95.1, 1.94.3, 1.93.2, 1.92.2, 1.91.5, 1.90.7, 1.89.7, and 1.88.6.
Workarounds
Set general_settings.allow_client_side_credentials to false so callers cannot override connection parameters, restrict proxy keys to trusted callers, and block the affected parameters (api_base, base_url, model_list, fallbacks, provider credential fields) at a reverse proxy or API gateway.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| litellm | < 1.88.6 |
1.88.6 |
| litellm | >= 1.89.0, < 1.89.7 |
1.89.7 |
| litellm | >= 1.90.0, < 1.90.7 |
1.90.7 |
| litellm | >= 1.91.0, < 1.91.5 |
1.91.5 |
| litellm | >= 1.92.0, < 1.92.2 |
1.92.2 |
| litellm | >= 1.93.0, < 1.93.2 |
1.93.2 |
| litellm | >= 1.94.0, < 1.94.3 |
1.94.3 |
| litellm | >= 1.95.0, < 1.95.1 |
1.95.1 |
| litellm | >= 1.96.0, < 1.96.2 |
1.96.2 |
| litellm | < 1.88.6>= 1.89.0, < 1.89.7>= 1.90.0, < 1.90.7>= 1.91.0, < 1.91.5>= 1.92.0, < 1.92.2>= 1.93.0, < 1.93.2>= 1.94.0, < 1.94.3>= 1.95.0, < 1.95.1>= 1.96.0, < 1.96.2 |
1.88.61.89.71.90.71.91.51.92.21.93.21.94.31.95.11.96.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
litellm PyPI → 1.88.6
- pip
pip install --upgrade "litellm>=1.88.6"- poetry
poetry add "litellm>=1.88.6"- uv
uv add "litellm>=1.88.6"
Severity breakdown
CVSS 3.1 6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-918: Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
References
Advisories
Packages
Other links
- github.com/BerriAI/litellm/security/advisories/GHSA-3cv6-jpf6-8222
- github.com/BerriAI/litellm/pull/36011
- github.com/BerriAI/litellm/pull/36314
- github.com/BerriAI/litellm/pull/36494
- github.com/BerriAI/litellm/commit/473f72e63a9777d793fbbf57194d8ec4fb97bc1b
- github.com/BerriAI/litellm/commit/820f247a6abba55cd87d130bef7bba7be3b29d37
- github.com/BerriAI/litellm/commit/c898d341c02299cf2506d0d8e84cc67953043593
- github.com/BerriAI/litellm/releases/tag/v1.88.6
- github.com/BerriAI/litellm/releases/tag/v1.96.2
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-7488-6r32-c95q LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback | High Known exploited | Also affects litellm |
| GHSA-v4p8-mg3p-g94g LiteLLM: Authenticated command execution via MCP stdio test endpoints | High Known exploited | Also affects litellm |
| GHSA-r75f-5x8p-qvmc LiteLLM has SQL Injection in Proxy API key verification | Critical Known exploited | Also affects litellm |
| GHSA-g5ff-637f-6q2m LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials` | High | Also affects litellm |
| GHSA-hhww-mrg2-969h LiteLLM vulnerable to reflected XSS in /sso/debug/callback | Medium | Also affects litellm |
| GHSA-7hp6-4w63-5g45 LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key | Critical | Also affects litellm |
| GHSA-hx8v-g79f-8w5f LiteLLM Proxy has server-side request forgery via the `user_config` request parameter | Medium | Also affects litellm |
| GHSA-6wvf-77m9-58rm LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint | Critical | Also affects litellm |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor