Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-84377— LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters

Quick assessment

Affected
BerriAI litellm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

LiteLLM 是一个代理服务器（AI 网关），用于以 OpenAI（或原生）格式调用 LLM API。在 1.88.6 和 1.96.2 之前的版本中，任何已认证的 LiteLLM 代理用户都可以将出站的服务提供商调用重定向到用户可控的目标地址，从而导致代理将其配置的服务提供商凭证发送到该目标地址。 在 、 、 、 和 中的请求校验使用了不完整的检查，未能覆盖所有敏感参数，也未能检查嵌套请求字段、路径值以及括号表示法表单数据中的等效值。因此，包括 、 、 、 和 在内的路由和凭证参数可以在未清除操作者存储的密钥的

CVSS 6.5 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-84377

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters
Source: CVE Program / CVE List V5
Vulnerability Description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials to that destination. Request validation in litellm/proxy/auth/auth_utils.py, litellm/proxy/common_request_processing.py, litellm/proxy/health_endpoints/_health_endpoints.py, litellm/proxy/image_endpoints/endpoints.py, and litellm/proxy/litellm_pre_call_utils.py used incomplete checks that did not cover every sensitive parameter or inspect equivalent values across nested request fields, path values, and bracket-notation form data. Routing and credential parameters including api_base, base_url, model_list, fallbacks, and litellm_credential_name could therefore be applied without clearing the operator's stored key, exposing upstream provider credentials and other configured secrets and permitting server-side requests to internal services reachable by the proxy. This issue is fixed in versions 1.88.6 and 1.96.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
BerriAI litellm < 1.88.6 -

II. Public POCs for CVE-2026-84377

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-84377

请登录查看更多情报信息。

Other References for CVE-2026-84377 (9)

IV. Related Vulnerabilities

Same product: litellm
Same vendor: BerriAI
Same weakness: CWE-918

V. Comments for CVE-2026-84377

No comments yet

Leave a comment