All vulnerabilities
CVE-2026-84377GHSA-3cv6-jpf6-8222PYSEC-2026-4066

LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters

BerriAI litellmpipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.54%Chance of exploitation activity in the next 30 days, higher than 44% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.88.6Also 1.89.7, 1.90.7 and 6 moreGitHub
Published2 Sep 2026Updated 1 Oct 2026CVE List

What fixes it

Show all 18 fixed versions
  • 1.94.3litellm, pipGitHub
  • 1.95.1litellm, pipGitHub
  • 1.96.2litellm, pipGitHub
  • 1.88.6litellm, PyPIOSVpip install "litellm>=1.88.6"
  • 1.89.7litellm, PyPIOSVpip install "litellm>=1.89.7"
  • 1.90.7litellm, PyPIOSVpip install "litellm>=1.90.7"
  • 1.91.5litellm, PyPIOSVpip install "litellm>=1.91.5"
  • 1.92.2litellm, PyPIOSVpip install "litellm>=1.92.2"
  • 1.93.2litellm, PyPIOSVpip install "litellm>=1.93.2"
  • 1.94.3litellm, PyPIOSVpip install "litellm>=1.94.3"
  • 1.95.1litellm, PyPIOSVpip install "litellm>=1.95.1"
  • 1.96.2litellm, PyPIOSVpip install "litellm>=1.96.2"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

Any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination they control and cause the proxy to send its own configured provider credentials to that destination. The proxy's request-body validation was a denylist that did not cover every sensitive parameter and did not inspect parameters nested inside other request fields, so a caller could supply a routing or credential value that the proxy applied without clearing the operator's stored key. Any authenticated user could therefore exfiltrate the operator's upstream provider credentials and other configured secrets, and perform Server-Side Request Forgery against internal services reachable from the proxy.

Patches

Fixed in 1.96.2, 1.95.1, 1.94.3, 1.93.2, 1.92.2, 1.91.5, 1.90.7, 1.89.7, and 1.88.6.

Workarounds

Set general_settings.allow_client_side_credentials to false so callers cannot override connection parameters, restrict proxy keys to trusted callers, and block the affected parameters (api_base, base_url, model_list, fallbacks, provider credential fields) at a reverse proxy or API gateway.

Text from GitHub Advisory Database

Affected versions 99

  • litellm, pip< 1.88.6GitHub
  • litellm, pip>= 1.89.0, < 1.89.7GitHub
  • litellm, pip>= 1.90.0, < 1.90.7GitHub
  • litellm, pip>= 1.91.0, < 1.91.5GitHub
  • litellm, pip>= 1.92.0, < 1.92.2GitHub
  • litellm, pip>= 1.93.0, < 1.93.2GitHub
  • litellm, pip>= 1.94.0, < 1.94.3GitHub
  • litellm, pip>= 1.95.0, < 1.95.1GitHub
  • litellm, pip>= 1.96.0, < 1.96.2GitHub
  • litellmaffected: < 1.88.6CVE List
  • litellmaffected: >= 1.89.0, < 1.96.2CVE List
  • litellm, pip<1.94.0GitHub
  • litellm, PyPIfrom first release, fixed in 1.88.6OSV
  • litellm, PyPI0.1.0OSV
  • litellm, PyPI0.1.1OSV
  • litellm, PyPI0.1.2OSV
  • litellm, PyPI0.1.201OSV
  • litellm, PyPI0.1.202OSV
  • litellm, PyPI0.1.203OSV
  • litellm, PyPI0.1.204OSV
  • litellm, PyPI0.1.205OSV
  • litellm, PyPI0.1.206OSV
  • litellm, PyPI0.1.207OSV
  • litellm, PyPI0.1.208OSV
  • litellm, PyPI0.1.209OSV
  • litellm, PyPI0.1.210OSV
  • litellm, PyPI0.1.211OSV
  • litellm, PyPI0.1.212OSV
  • litellm, PyPI0.1.213OSV
  • litellm, PyPI0.1.214OSV
  • litellm, PyPI0.1.215OSV
  • litellm, PyPI0.1.216OSV
  • litellm, PyPI0.1.217OSV
  • litellm, PyPI0.1.218OSV
  • litellm, PyPI0.1.219OSV
  • litellm, PyPI0.1.220OSV
  • litellm, PyPI0.1.221OSV
  • litellm, PyPI0.1.222OSV
  • litellm, PyPI0.1.223OSV
  • litellm, PyPI0.1.224OSV
  • litellm, PyPI0.1.225OSV
  • litellm, PyPI0.1.226OSV
  • litellm, PyPI0.1.227OSV
  • litellm, PyPI0.1.228OSV
  • litellm, PyPI0.1.229OSV
  • litellm, PyPI0.1.2291OSV
  • litellm, PyPI0.1.230OSV
  • litellm, PyPI0.1.231OSV
  • litellm, PyPI0.1.232OSV
  • litellm, PyPI0.1.233OSV
  • litellm, PyPI0.1.234OSV
  • litellm, PyPI0.1.235OSV
  • litellm, PyPI0.1.236OSV
  • litellm, PyPI0.1.237OSV
  • litellm, PyPI0.1.238OSV
  • litellm, PyPI0.1.3OSV
  • litellm, PyPI0.1.31OSV
  • litellm, PyPI0.1.32OSV
  • litellm, PyPI0.1.330OSV
  • litellm, PyPI0.1.331OSV
  • litellm, PyPI0.1.34OSV
  • litellm, PyPI0.1.341OSV
  • litellm, PyPI0.1.343OSV
  • litellm, PyPIfrom 1.89.0, fixed in 1.89.7OSV
  • litellm, PyPI1.89.0OSV
  • litellm, PyPI1.89.1OSV
  • litellm, PyPI1.89.2OSV
  • litellm, PyPI1.89.3OSV
  • litellm, PyPI1.89.4OSV
  • litellm, PyPI1.89.5OSV
  • litellm, PyPI1.89.6OSV
  • litellm, PyPIfrom 1.90.0, fixed in 1.90.7OSV
  • litellm, PyPI1.90.0OSV
  • litellm, PyPI1.90.1OSV
  • litellm, PyPI1.90.2OSV
  • litellm, PyPI1.90.3OSV
  • litellm, PyPI1.90.4OSV
  • litellm, PyPI1.90.5OSV
  • litellm, PyPI1.90.6OSV
  • litellm, PyPIfrom 1.91.0, fixed in 1.91.5OSV
  • litellm, PyPI1.91.0OSV
  • litellm, PyPI1.91.1OSV
  • litellm, PyPI1.91.2OSV
  • litellm, PyPI1.91.3OSV
  • litellm, PyPI1.91.4OSV
  • litellm, PyPIfrom 1.92.0, fixed in 1.92.2OSV
  • litellm, PyPI1.92.0OSV
  • litellm, PyPI1.92.1OSV
  • litellm, PyPIfrom 1.93.0, fixed in 1.93.2OSV
  • litellm, PyPI1.93.0OSV
  • litellm, PyPI1.93.1OSV
  • litellm, PyPIfrom 1.94.0, fixed in 1.94.3OSV
  • litellm, PyPI1.94.0OSV
  • litellm, PyPI1.94.1OSV
  • litellm, PyPI1.94.2OSV
  • litellm, PyPIfrom 1.95.0, fixed in 1.95.1OSV
  • litellm, PyPI1.95.0OSV
  • litellm, PyPIfrom 1.96.0, fixed in 1.96.2OSV
  • litellm, PyPI1.96.0OSV

References 11