Executive brief
LiteLLM Proxy is a gateway service that forwards AI API requests to various language model providers. An authenticated user can bypass the proxy's security controls by smuggling a malicious API endpoint URL inside a nested parameter, causing the proxy to make requests to attacker-controlled servers and potentially exposing internal infrastructure or sensitive data.
Technical details
This is a server-side request forgery (SSRF) vulnerability in LiteLLM Proxy's request validation logic. The application uses an `is_request_body_safe` function to block dangerous parameters (`api_base` and `base_url`) at the top level of the request body. However, the guard does not recursively validate nested objects, allowing an authenticated attacker to place an `api_base` parameter inside the `user_config` object. Since `user_config` is used to configure the outbound router, the nested malicious URL causes the proxy to redirect its request to an arbitrary host controlled by the attacker. Exploitation requires possession of a valid virtual key (authentication credential). The vulnerability affects LiteLLM versions 1.83.8 and earlier; version 1.83.9 and later contain the fix.
Affected products
- BerriAI LiteLLM <= 1.83.8
Timeline
- 2026-08-26: disclosed
- 2026-09-17: advisory
- 2026-04-17: patched: Version 1.83.9 released with fix