Executive brief
LiteLLM is an AI Gateway proxy that forwards requests to LLM providers like OpenAI. An authenticated user could manipulate request parameters across multiple input formats (request body, URL path, and form fields) to bypass validation checks and redirect outbound API calls to an attacker-controlled destination, causing the proxy to leak its stored provider credentials and secrets. This allows credential theft and potential server-side request forgery attacks against internal services.
Technical details
This is an input validation bypass vulnerability affecting multiple proxy request-processing modules (auth_utils.py, common_request_processing.py, health_endpoints, image_endpoints, and litellm_pre_call_utils.py). The vulnerability stems from incomplete checks that do not consistently validate sensitive routing and credential parameters (api_base, base_url, model_list, fallbacks, litellm_credential_name) across all input vectors—request body, nested fields, URL paths, and bracket-notation form data. An authenticated attacker can supply equivalent malicious values in unchecked alternate locations to bypass validation and cause the proxy to send configured upstream provider credentials to attacker-controlled servers. Attack requires valid proxy authentication. Fixed in versions 1.88.6 and 1.96.2.
Affected products
- BerriAI LiteLLM before 1.88.6 and before 1.96.2
Timeline
- 2026-09-02: disclosed: CVE-2026-84377 published
- 2026-08-07: patched: Fix applied in versions 1.88.6 and 1.96.2