# CVE-2026-84377: LiteLLM proxy request parameter injection leading to credential exposure

Source: https://junglewise.ai/threats/cve-2026-84377-litellm-proxy-request-parameter-injection-leading-to-credential  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-84377 · Severity: medium · CVSS 6.5 · Published 2026-09-02

LiteLLM is an AI Gateway proxy that forwards requests to LLM providers like OpenAI. An authenticated user could manipulate request parameters across multiple input formats (request body, URL path, and form fields) to bypass validation checks and redirect outbound API calls to an attacker-controlled destination, causing the proxy to leak its stored provider credentials and secrets. This allows credential theft and potential server-side request forgery attacks against internal services.

Technologies: [Berriai LiteLLM](https://junglewise.ai/threats/technologies/litellm), [litellm (PyPI)](https://junglewise.ai/threats/technologies/pypi-litellm). Vendors: [Berriai](https://junglewise.ai/threats/vendors/berriai), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-84377 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84377 being exploited in the wild.

**How severe is CVE-2026-84377?** Medium severity, with a CVSS score of 6.5, published 2 September 2026.

**Which products and versions are affected?** Berriai LiteLLM before 1.88.6 and before 1.96.2; litellm (PyPI) ECOSYSTEM:introduced=0,fixed=1.88.6, ECOSYSTEM:introduced=0,fixed=1.88.6,introduced=1.89.0,fixed=1.89.7,introduced=1.90.0,fixed=1.90.7,introduced=1.91.0,fixed=1.91.5,introduced=1.92.0,fixed=1.92.2,introduced=1.93.0,fixed=1.93.2,introduced=1.94.0,fixed=1.94.3,introduced=1.95.0,fixed=1.95.1,introduced=1.96.0,fixed=1.96.2.

**Is there a fix for CVE-2026-84377?** Yes. litellm (PyPI): upgrade to 1.88.6, 1.96.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84377 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-84377?** Check whether you run Berriai LiteLLM or litellm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- litellm (PyPI): upgrade to 1.88.6, 1.96.2 or later

  ```sh
  pip install "litellm>=1.96.2"
  ```


## Technical details

This is an input validation bypass vulnerability affecting multiple proxy request-processing modules (auth_utils.py, common_request_processing.py, health_endpoints, image_endpoints, and litellm_pre_call_utils.py). The vulnerability stems from incomplete checks that do not consistently validate sensitive routing and credential parameters (api_base, base_url, model_list, fallbacks, litellm_credential_name) across all input vectors—request body, nested fields, URL paths, and bracket-notation form data. An authenticated attacker can supply equivalent malicious values in unchecked alternate locations to bypass validation and cause the proxy to send configured upstream provider credentials to attacker-controlled servers. Attack requires valid proxy authentication. Fixed in versions 1.88.6 and 1.96.2.

## Affected products

- BerriAI LiteLLM before 1.88.6 and before 1.96.2

## Identifiers

- CVE-2026-84377
- GHSA-3cv6-jpf6-8222
- PYSEC-2026-4066

## Timeline

- 2026-09-02: disclosed: CVE-2026-84377 published
- 2026-08-07: patched: Fix applied in versions 1.88.6 and 1.96.2

## References

- [https://github.com/BerriAI/litellm/commit/473f72e63a9777d793fbbf57194d8ec4fb97bc1b](https://github.com/BerriAI/litellm/commit/473f72e63a9777d793fbbf57194d8ec4fb97bc1b)
- [https://github.com/BerriAI/litellm/commit/820f247a6abba55cd87d130bef7bba7be3b29d37](https://github.com/BerriAI/litellm/commit/820f247a6abba55cd87d130bef7bba7be3b29d37)

## Related threats

- [LiteLLM arbitrary local file read via vertex_ai_credentials](https://junglewise.ai/threats/litellm-internal-user-viewer-arbitrary-local-file-read-via-vertex-ai-649a7475)
- [LiteLLM reflected XSS in SSO debug callback endpoint](https://junglewise.ai/threats/litellm-vulnerable-to-reflected-xss-in-sso-debug-callback-38154651)
- [LiteLLM proxy authentication bypass via reused crypto context](https://junglewise.ai/threats/cve-2026-114612-litellm-is-a-proxy-server-ai-gateway-to-call-llm-apis-in-openai)
- [BerriAI LiteLLM improper authorization in secret resolution](https://junglewise.ai/threats/cve-2026-108575-a-vulnerability-has-been-found-in-berriai-litellm-up-to-1-94-0)
- [BerriAI LiteLLM authorization bypass in spend tracking](https://junglewise.ai/threats/cve-2026-108574-a-flaw-has-been-found-in-berriai-litellm-up-to-1-95-0-affected)