CVE-2026-84377: LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters
Any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination they control and cause the proxy to send its own configured provider credentials to that destination.
What it is
Any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination they control and cause the proxy to send its own configured provider credentials to that destination. The proxy's request-body validation was a denylist that did not cover every sensitive parameter and did not inspect parameters nested inside other request fields, so a caller could supply a routing or credential value that the proxy applied without clearing the operator's stored key.
Fixed in 1.96.2, 1.95.1, 1.94.3, 1.93.2, 1.92.2, 1.91.5, 1.90.7, 1.89.7, and 1.88.6.
Set general_settings.allow_client_side_credentials to false so callers cannot override connection parameters, restrict proxy keys to trusted callers, and block the affected parameters (api_base, base_url, model_list, fallbacks, provider credential fields) at a reverse proxy or API gateway.
How to check
- Affected: litellm (pip) < 1.88.6.
- Affected: litellm (pip) >= 1.89.0, < 1.89.7.
- Affected: litellm (pip) >= 1.90.0, < 1.90.7.
- Affected: litellm (pip) >= 1.91.0, < 1.91.5.
- Affected: litellm (pip) >= 1.92.0, < 1.92.2.
- Affected: litellm (pip) >= 1.93.0, < 1.93.2.
- Affected: litellm (pip) >= 1.94.0, < 1.94.3.
- Affected: litellm (pip) >= 1.95.0, < 1.95.1.
- Affected: litellm (pip) >= 1.96.0, < 1.96.2.
- Compare your installed version with the range above (command below).
How to fix
- Upgrade litellm to 1.88.6 or later.
- Upgrade litellm to 1.89.7 or later.
- Upgrade litellm to 1.90.7 or later.
- Upgrade litellm to 1.91.5 or later.
- Upgrade litellm to 1.92.2 or later.
- Upgrade litellm to 1.93.2 or later.
- Upgrade litellm to 1.94.3 or later.
- Upgrade litellm to 1.95.1 or later.
- Upgrade litellm to 1.96.2 or later.
pip show litellm | grep Version