AIKIDO-2026-215054

litellm is vulnerable to Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF)CVE-2026-84377 Published 2 days ago

Medium Risk

This Affects:

litellm

0.1.387 - 1.88.5

Fixed in 1.88.6

1.89.0 - 1.89.6

Fixed in 1.89.7

1.90.0 - 1.90.6

Fixed in 1.90.7

1.91.0 - 1.91.4

Fixed in 1.91.5

1.92.0 - 1.92.1

Fixed in 1.92.2

1.93.0 - 1.93.1

Fixed in 1.93.2

1.94.0 - 1.94.2

Fixed in 1.94.3

1.95.0 - 1.95.0

Fixed in 1.95.1

1.96.0 - 1.96.1

Fixed in 1.96.2

Are you affected? Scan for Free

TL;DR

The LiteLLM proxy accepts routing and credential parameters such as api_base, base_url, model_list, fallbacks, and litellm_credential_name in the request body. Request validation missed equivalent values nested in other fields, in path values, and in bracket-notation form data. An authenticated proxy user can redirect an outbound provider call to an untrusted destination while the proxy still attaches its configured provider credentials. That leaks those secrets and lets the caller reach internal services the proxy can access.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you run the LiteLLM proxy.

Background info

litellm is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.1.387 - 1.88.5, 1.89.0 - 1.89.6, 1.90.0 - 1.90.6, 1.91.0 - 1.91.4, 1.92.0 - 1.92.1, 1.93.0 - 1.93.1, 1.94.0 - 1.94.2, 1.95.0 - 1.95.0 and 1.96.0 - 1.96.1.