Skip to content
Fencer Vulns
medium 6.5

CVE-2026-84377 json

LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters

published 2026-09-02 2 mo ago modified 2026-10-01 38 d ago also GHSA-3cv6-jpf6-8222 , PYSEC-2026-4066 , EUVD-2026-70236

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits
0
none known

Summary

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials to that destination. Request validation in litellm/proxy/auth/auth_utils.py, litellm/proxy/common_request_processing.py, litellm/proxy/health_endpoints/_health_endpoints.py, litellm/proxy/image_endpoints/endpoints.py, and litellm/proxy/litellm_pre_call_utils.py used incomplete checks that did not cover every sensitive parameter or inspect equivalent values across nested request fields, path values, and bracket-notation form data. Routing and credential parameters including api_base, base_url, model_list, fallbacks, and litellm_credential_name could therefore be applied without clearing the operator's stored key, exposing upstream provider credentials and other configured secrets and permitting server-side requests to internal services reachable by the proxy. This issue is fixed in versions 1.88.6 and 1.96.2.

Patch / fix

  • pypi litellm 1.88.6, 1.89.7, 1.90.7, 1.91.5, 1.92.2, 1.93.2, 1.94.3, 1.95.1, 1.96.2
  • python-litellm openSUSE Tumbleweed 1.101.0-1.1

opensuse advisories openSUSE-SU-2026:11800-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-84377 updated cvss 6.5

litellm: LiteLLM: Authenticated Server-Side Request Forgery and credential exposure

  • Red Hat Exploit Intelligence exploit-intelligence-tech-preview/vulnerability-analysis-rhel9
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Lightspeed Core lightspeed-core/lightspeed-stack-rhel9 Red Hat Ansible Automation Platform 2 ansible-automation-platform-26/lightspeed-chatbot-rhel9, ansible-automation-platform-27/lightspeed-chatbot-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9, rhoai/odh-llama-stack-core-rhel9, rhoai/odh-th-torch-cpu-py312-rhel9, rhoai/odh-th-torch-cuda-py312-rhel9, rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9
    affected: workaround, no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.54% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
OSV 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
pypi litellm
<1.88.6
>=1.89.0, <1.89.7
>=1.90.0, <1.90.7
>=1.91.0, <1.91.5
>=1.92.0, <1.92.2
>=1.93.0, <1.93.2
>=1.94.0, <1.94.3
>=1.95.0, <1.95.1
>=1.96.0, <1.96.2
1.88.6
1.89.7
1.90.7
1.91.5
1.92.2
1.93.2
1.94.3
1.95.1
1.96.2

Affected products

  • BerriAI litellm

Classification

Weakness
  • CWE-918 Server-Side Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.