Is CVE-2026-84377 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84377 being exploited in the wild.

How severe is CVE-2026-84377?

Medium severity, with a CVSS score of 6.5, published 2 September 2026.

Which products and versions are affected?

Berriai LiteLLM before 1.88.6 and before 1.96.2; litellm (PyPI) ECOSYSTEM:introduced=0,fixed=1.88.6, ECOSYSTEM:introduced=0,fixed=1.88.6,introduced=1.89.0,fixed=1.89.7,introduced=1.90.0,fixed=1.90.7,introduced=1.91.0,fixed=1.91.5,introduced=1.92.0,fixed=1.92.2,introduced=1.93.0,fixed=1.93.2,introduced=1.94.0,fixed=1.94.3,introduced=1.95.0,fixed=1.95.1,introduced=1.96.0,fixed=1.96.2.

Is there a fix for CVE-2026-84377?

Yes. litellm (PyPI): upgrade to 1.88.6, 1.96.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-84377 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-84377?

Check whether you run Berriai LiteLLM or litellm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84377: LiteLLM proxy request parameter injection leading to credential exposure

CVE-2026-84377 · Severity: medium · CVSS 6.5 · Published 2026-09-02

LiteLLM is an AI Gateway proxy that forwards requests to LLM providers like OpenAI. An authenticated user could manipulate request parameters across multiple input formats (request body, URL path, and form fields) to bypass validation checks and redirect outbound API calls to an attacker-controlled destination, causing the proxy to leak its stored provider credentials and secrets. This allows credential theft and potential server-side request forgery attacks against internal services.

Technologies: Berriai LiteLLM, litellm (PyPI). Vendors: Berriai, PyPI.

Quick answers

Is CVE-2026-84377 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84377 being exploited in the wild.
How severe is CVE-2026-84377?: Medium severity, with a CVSS score of 6.5, published 2 September 2026.
Which products and versions are affected?: Berriai LiteLLM before 1.88.6 and before 1.96.2; litellm (PyPI) ECOSYSTEM:introduced=0,fixed=1.88.6, ECOSYSTEM:introduced=0,fixed=1.88.6,introduced=1.89.0,fixed=1.89.7,introduced=1.90.0,fixed=1.90.7,introduced=1.91.0,fixed=1.91.5,introduced=1.92.0,fixed=1.92.2,introduced=1.93.0,fixed=1.93.2,introduced=1.94.0,fixed=1.94.3,introduced=1.95.0,fixed=1.95.1,introduced=1.96.0,fixed=1.96.2.
Is there a fix for CVE-2026-84377?: Yes. litellm (PyPI): upgrade to 1.88.6, 1.96.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84377 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-84377?: Check whether you run Berriai LiteLLM or litellm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

litellm (PyPI): upgrade to 1.88.6, 1.96.2 or later
```
pip install "litellm>=1.96.2"
```

Technical details

This is an input validation bypass vulnerability affecting multiple proxy request-processing modules (auth_utils.py, common_request_processing.py, health_endpoints, image_endpoints, and litellm_pre_call_utils.py). The vulnerability stems from incomplete checks that do not consistently validate sensitive routing and credential parameters (api_base, base_url, model_list, fallbacks, litellm_credential_name) across all input vectors—request body, nested fields, URL paths, and bracket-notation form data. An authenticated attacker can supply equivalent malicious values in unchecked alternate locations to bypass validation and cause the proxy to send configured upstream provider credentials to attacker-controlled servers. Attack requires valid proxy authentication. Fixed in versions 1.88.6 and 1.96.2.

Affected products

BerriAI LiteLLM before 1.88.6 and before 1.96.2

Identifiers

CVE-2026-84377
GHSA-3cv6-jpf6-8222
PYSEC-2026-4066

Timeline

2026-09-02: disclosed: CVE-2026-84377 published
2026-08-07: patched: Fix applied in versions 1.88.6 and 1.96.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.