# CVE-2026-59823: LiteLLM Proxy server-side request forgery in user_config parameter

Source: https://junglewise.ai/threats/cve-2026-59823-litellm-proxy-server-side-request-forgery-in-user-config  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-59823 · Severity: medium · CVSS 4 · Published 2026-09-16

LiteLLM Proxy is a gateway service that forwards AI API requests to various language model providers. An authenticated user can bypass the proxy's security controls by smuggling a malicious API endpoint URL inside a nested parameter, causing the proxy to make requests to attacker-controlled servers and potentially exposing internal infrastructure or sensitive data.

Technologies: [Berriai LiteLLM](https://junglewise.ai/threats/technologies/litellm), [litellm (PyPI)](https://junglewise.ai/threats/technologies/pypi-litellm). Vendors: [Berriai](https://junglewise.ai/threats/vendors/berriai), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-59823 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59823 being exploited in the wild.

**How severe is CVE-2026-59823?** Medium severity, with a CVSS score of 4, published 16 September 2026.

**Which products and versions are affected?** Berriai LiteLLM <= 1.83.8; litellm (PyPI) ECOSYSTEM:introduced=0,fixed=1.83.9.

**Is there a fix for CVE-2026-59823?** Yes. litellm (PyPI): upgrade to 1.83.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59823 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-59823?** Check whether you run Berriai LiteLLM or litellm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- litellm (PyPI): upgrade to 1.83.9 or later

  ```sh
  pip install "litellm>=1.83.9"
  ```


## Technical details

This is a server-side request forgery (SSRF) vulnerability in LiteLLM Proxy's request validation logic. The application uses an `is_request_body_safe` function to block dangerous parameters (`api_base` and `base_url`) at the top level of the request body. However, the guard does not recursively validate nested objects, allowing an authenticated attacker to place an `api_base` parameter inside the `user_config` object. Since `user_config` is used to configure the outbound router, the nested malicious URL causes the proxy to redirect its request to an arbitrary host controlled by the attacker. Exploitation requires possession of a valid virtual key (authentication credential). The vulnerability affects LiteLLM versions 1.83.8 and earlier; version 1.83.9 and later contain the fix.

## Affected products

- BerriAI LiteLLM <= 1.83.8

## Identifiers

- CVE-2026-59823
- GHSA-hx8v-g79f-8w5f
- PYSEC-2026-4070

## Timeline

- 2026-08-26: disclosed
- 2026-09-17: advisory
- 2026-04-17: patched: Version 1.83.9 released with fix

## References

- [https://api.github.com/users/brettgus](https://api.github.com/users/brettgus)
- [https://github.com/brettgus](https://github.com/brettgus)
- [https://api.github.com/users/brettgus/gists%7B/gist_id%7D](https://api.github.com/users/brettgus/gists%7B/gist_id%7D)
- [https://api.github.com/users/brettgus/repos](https://api.github.com/users/brettgus/repos)
- [https://avatars.githubusercontent.com/u/4873772?v=4](https://avatars.githubusercontent.com/u/4873772?v=4)
- [https://api.github.com/users/brettgus/events%7B/privacy%7D](https://api.github.com/users/brettgus/events%7B/privacy%7D)

## Related threats

- [LiteLLM arbitrary local file read via vertex_ai_credentials](https://junglewise.ai/threats/litellm-internal-user-viewer-arbitrary-local-file-read-via-vertex-ai-649a7475)
- [LiteLLM reflected XSS in SSO debug callback endpoint](https://junglewise.ai/threats/litellm-vulnerable-to-reflected-xss-in-sso-debug-callback-38154651)
- [LiteLLM proxy authentication bypass via reused crypto context](https://junglewise.ai/threats/cve-2026-114612-litellm-is-a-proxy-server-ai-gateway-to-call-llm-apis-in-openai)
- [BerriAI LiteLLM improper authorization in secret resolution](https://junglewise.ai/threats/cve-2026-108575-a-vulnerability-has-been-found-in-berriai-litellm-up-to-1-94-0)
- [BerriAI LiteLLM authorization bypass in spend tracking](https://junglewise.ai/threats/cve-2026-108574-a-flaw-has-been-found-in-berriai-litellm-up-to-1-95-0-affected)