CVE-2026-84377 · GHSA-3cv6-jpf6-8222

LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters

Risk score: 53/100
CVSS: 6.5 v3.1
Exploit chance (30 days): 0.5%
Published: 30 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is: Any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination they control and cause the proxy to send its own configured provider credentials to that destination. The proxy's request-body validation was a denylist that did not cover every sensitive parameter and did not inspect parame…
Affected: litellm (pip) < 1.88.6; litellm (pip) >= 1.89.0, < 1.89.7; litellm (pip) >= 1.90.0, < 1.90.7; litellm (pip) >= 1.91.0, < 1.91.5
Fix: Upgrade litellm to 1.88.6 or 1.89.7 or 1.90.7 or 1.91.5 or 1.92.2 or 1.93.2 or 1.94.3 or 1.95.1 (whichever matches your release line) or later.
Exploitation: No known exploitation

Why it is Yellow

CVSS 6.5 medium
On your watchlist: PyPI

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
litellm	pip	< 1.88.6	1.88.6
litellm	pip	>= 1.89.0, < 1.89.7	1.89.7
litellm	pip	>= 1.90.0, < 1.90.7	1.90.7
litellm	pip	>= 1.91.0, < 1.91.5	1.91.5
litellm	pip	>= 1.92.0, < 1.92.2	1.92.2
litellm	pip	>= 1.93.0, < 1.93.2	1.93.2
litellm	pip	>= 1.94.0, < 1.94.3	1.94.3
litellm	pip	>= 1.95.0, < 1.95.1	1.95.1
litellm	pip	>= 1.96.0, < 1.96.2	1.96.2

References

Original description

### Impact Any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination they control and cause the proxy to send its own configured provider credentials to that destination. The proxy's request-body validation was a denylist that did not cover every sensitive parameter and did not inspect parameters nested inside other request fields, so a caller could supply a routing or credential value that the proxy applied without clearing the operator's stored key. Any authenticated user could therefore exfiltrate the operator's upstream provider credentials and other configured secrets, and perform Server-Side Request Forgery against internal services reachable from the proxy. ### Patches Fixed in 1.96.2, 1.95.1, 1.94.3, 1.93.2, 1.92.2, 1.91.5, 1.90.7, 1.89.7, and 1.88.6. ### Workarounds Set `general_settings.allow_client_side_credentials` to `false` so callers cannot override connection parameters, restrict proxy keys to trusted callers, and block the affected parameters (`api_base`, `base_url`, `model_list`, `fallbacks`, provider credential fields) at a reverse proxy or API gateway.

Last activity 30 Sep 2026. Patch Forecast updates every hour.