CVE-2026-59823: LiteLLM Proxy server-side request forgery in user_config parameter

CVE-2026-59823 · Severity: medium · CVSS 4 · Published 2026-09-16

LiteLLM Proxy is a gateway service that forwards AI API requests to various language model providers. An authenticated user can bypass the proxy's security controls by smuggling a malicious API endpoint URL inside a nested parameter, causing the proxy to make requests to attacker-controlled servers and potentially exposing internal infrastructure or sensitive data.

Technologies: Berriai LiteLLM, litellm (PyPI). Vendors: Berriai, PyPI.

Quick answers

Is CVE-2026-59823 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59823 being exploited in the wild.
How severe is CVE-2026-59823?
Medium severity, with a CVSS score of 4, published 16 September 2026.
Which products and versions are affected?
Berriai LiteLLM <= 1.83.8; litellm (PyPI) ECOSYSTEM:introduced=0,fixed=1.83.9.
Is there a fix for CVE-2026-59823?
Yes. litellm (PyPI): upgrade to 1.83.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59823 attacked?
It is attacked over the network.
Am I affected by CVE-2026-59823?
Check whether you run Berriai LiteLLM or litellm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • litellm (PyPI): upgrade to 1.83.9 or later
    pip install "litellm>=1.83.9"

Technical details

This is a server-side request forgery (SSRF) vulnerability in LiteLLM Proxy's request validation logic. The application uses an `is_request_body_safe` function to block dangerous parameters (`api_base` and `base_url`) at the top level of the request body. However, the guard does not recursively validate nested objects, allowing an authenticated attacker to place an `api_base` parameter inside the `user_config` object. Since `user_config` is used to configure the outbound router, the nested malicious URL causes the proxy to redirect its request to an arbitrary host controlled by the attacker. Exploitation requires possession of a valid virtual key (authentication credential). The vulnerability affects LiteLLM versions 1.83.8 and earlier; version 1.83.9 and later contain the fix.

Affected products

  • BerriAI LiteLLM <= 1.83.8

Identifiers

  • CVE-2026-59823
  • GHSA-hx8v-g79f-8w5f
  • PYSEC-2026-4070

Timeline

  • 2026-08-26: disclosed
  • 2026-09-17: advisory
  • 2026-04-17: patched: Version 1.83.9 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.