LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 4 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-918 and the CVSS impact.
Summary
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials to that destination. Request validation in litellm/proxy/auth/auth_utils.py, litellm/proxy/common_request_processing.py, litellm/proxy/health_endpoints/_health_endpoints.py, litellm/proxy/image_endpoints/endpoints.py, and litellm/proxy/litellm_pre_call_utils.py used incomplete checks that did not cover every sensitive parameter or inspect equivalent values across nested request fields, path values, and bracket-notation form data. Routing and credential parameters including api_base, base_url, model_list, fallbacks, and litellm_credential_name could therefore be applied without clearing the operator's stored key, exposing upstream provider credentials and other configured secrets and permitting server-side requests to internal services reachable by the proxy. This issue is fixed in versions 1.88.6 and 1.96.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| BerriAI | litellm | before 1.88.6; 1.89.0 to before 1.96.2 | 1.88.6, 1.96.2 | Patch available | CNA |
| — | litellm (PyPI) | before 1.88.6 | 1.88.6 | Patch available | GHSA-3cv6-jpf6-8222 |
| — | litellm (PyPI) | 1.89.0 to before 1.89.7 | 1.89.7 | Patch available | GHSA-3cv6-jpf6-8222 |
| — | litellm (PyPI) | 1.90.0 to before 1.90.7 | 1.90.7 | Patch available | GHSA-3cv6-jpf6-8222 |
| — | litellm (PyPI) | 1.91.0 to before 1.91.5 | 1.91.5 | Patch available | GHSA-3cv6-jpf6-8222 |
| — | litellm (PyPI) | 1.92.0 to before 1.92.2 | 1.92.2 | Patch available | GHSA-3cv6-jpf6-8222 |
| — | litellm (PyPI) | 1.93.0 to before 1.93.2 | 1.93.2 | Patch available | GHSA-3cv6-jpf6-8222 |
| — | litellm (PyPI) | 1.94.0 to before 1.94.3 | 1.94.3 | Patch available | GHSA-3cv6-jpf6-8222 |
| — | litellm (PyPI) | 1.95.0 to before 1.95.1 | 1.95.1 | Patch available | GHSA-3cv6-jpf6-8222 |
| — | litellm (PyPI) | 1.96.0 to before 1.96.2 | 1.96.2 | Patch available | GHSA-3cv6-jpf6-8222 |
- litellm VendorBerriAI Affected before 1.88.6; 1.89.0 to before 1.96.2 Fixed in 1.88.6, 1.96.2 Patch available CNA
- litellm (PyPI) Vendor— Affected before 1.88.6 Fixed in 1.88.6 Patch available GHSA-3cv6-jpf6-8222
- litellm (PyPI) Vendor— Affected 1.89.0 to before 1.89.7 Fixed in 1.89.7 Patch available GHSA-3cv6-jpf6-8222
- litellm (PyPI) Vendor— Affected 1.90.0 to before 1.90.7 Fixed in 1.90.7 Patch available GHSA-3cv6-jpf6-8222
- litellm (PyPI) Vendor— Affected 1.91.0 to before 1.91.5 Fixed in 1.91.5 Patch available GHSA-3cv6-jpf6-8222
- litellm (PyPI) Vendor— Affected 1.92.0 to before 1.92.2 Fixed in 1.92.2 Patch available GHSA-3cv6-jpf6-8222
- litellm (PyPI) Vendor— Affected 1.93.0 to before 1.93.2 Fixed in 1.93.2 Patch available GHSA-3cv6-jpf6-8222
- litellm (PyPI) Vendor— Affected 1.94.0 to before 1.94.3 Fixed in 1.94.3 Patch available GHSA-3cv6-jpf6-8222
- litellm (PyPI) Vendor— Affected 1.95.0 to before 1.95.1 Fixed in 1.95.1 Patch available GHSA-3cv6-jpf6-8222
- litellm (PyPI) Vendor— Affected 1.96.0 to before 1.96.2 Fixed in 1.96.2 Patch available GHSA-3cv6-jpf6-8222
Remediation
- Fix · CNA litellm (BerriAI) Fixed in 1.88.6, 1.96.2
- Fix · GHSA-3cv6-jpf6-8222 litellm (PyPI) Fixed in 1.88.6 Advisory →
- Fix · GHSA-3cv6-jpf6-8222 litellm (PyPI) Fixed in 1.89.7 Advisory →
- Fix · GHSA-3cv6-jpf6-8222 litellm (PyPI) Fixed in 1.90.7 Advisory →
- Fix · GHSA-3cv6-jpf6-8222 litellm (PyPI) Fixed in 1.91.5 Advisory →
- Fix · GHSA-3cv6-jpf6-8222 litellm (PyPI) Fixed in 1.92.2 Advisory →
- Fix · GHSA-3cv6-jpf6-8222 litellm (PyPI) Fixed in 1.93.2 Advisory →
- Fix · GHSA-3cv6-jpf6-8222 litellm (PyPI) Fixed in 1.94.3 Advisory →
- Fix · GHSA-3cv6-jpf6-8222 litellm (PyPI) Fixed in 1.95.1 Advisory →
- Fix · GHSA-3cv6-jpf6-8222 litellm (PyPI) Fixed in 1.96.2 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Exploit Intelligence | Affected | No fix planned: Out of support scope |
| Lightspeed Core | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-84377
- 2026-10-03 Alias added: GHSA-3cv6-jpf6-8222
References
Other 10
- https://github.com/BerriAI/litellm/security/advisories/GHSA-3cv6-jpf6-8222
- https://github.com/BerriAI/litellm/pull/36011
- https://github.com/BerriAI/litellm/pull/36314
- https://github.com/BerriAI/litellm/pull/36494
- https://github.com/BerriAI/litellm/commit/473f72e63a9777d793fbbf57194d8ec4fb97bc1b
- https://github.com/BerriAI/litellm/commit/820f247a6abba55cd87d130bef7bba7be3b29d37
- https://github.com/BerriAI/litellm/commit/c898d341c02299cf2506d0d8e84cc67953043593
- https://github.com/BerriAI/litellm/releases/tag/v1.88.6
- https://github.com/BerriAI/litellm/releases/tag/v1.96.2
- https://github.com/BerriAI/litellm
More BerriAI vulnerabilities
- TI-2026-26015 Trivy ecosystem supply chain briefly compromised KEVCVSS 4.0CRITICAL 9.4
- TI-2026-30529 LiteLLM: SQL injection in Proxy API key verification KEVCVSS 4.0CRITICAL 9.3
- TI-2026-30582 LiteLLM: Authenticated command execution via MCP stdio test endpoints KEVCVSS 4.0HIGH 8.7
- TI-2026-42639 LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback KEVCVSS 4.0HIGH 8.8
- TI-2024-05340 Remote Code Execution in BerriAI/litellm CVSS 3.1CRITICAL 9.8
- TI-2024-03969 Remote Code Execution in berriai/litellm CVSS 3.0CRITICAL 9.8
Sources
- CVE-2026-84377 · CVE Program
- CVE-2026-84377 · NVD
- FIRST EPSS
- GHSA-3cv6-jpf6-8222 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-84377 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences