CVE-2026-84377: LiteLLM Proxy Server SSRF Vulnerability

CVE-2026-84377 Overview

CVE-2026-84377 affects LiteLLM, an AI Gateway proxy server that translates calls to LLM APIs into OpenAI-compatible format. Any authenticated proxy user can redirect an outbound provider call to a destination they control. The proxy then transmits its configured provider credentials to that attacker-chosen endpoint. The flaw stems from incomplete request validation across multiple proxy modules that fail to inspect nested request fields, path values, and bracket-notation form data. This enables Server-Side Request Forgery (SSRF) [CWE-918] and exposure of upstream provider API keys and other configured secrets. The issue is fixed in versions 1.88.6 and 1.96.2.

Critical Impact
Authenticated users can exfiltrate stored LLM provider credentials and pivot to internal services reachable by the LiteLLM proxy.

Affected Products

LiteLLM proxy versions prior to 1.88.6
LiteLLM proxy versions prior to 1.96.2
Deployments using stored provider credentials (litellm_credential_name, provider API keys)

Discovery Timeline

2026-09-02 - CVE-2026-84377 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84377

Vulnerability Analysis

The LiteLLM proxy accepts routing and credential parameters in API requests, including api_base, base_url, model_list, fallbacks, and litellm_credential_name. Authenticated users can override these values on a per-request basis. When an override is supplied, the proxy must clear the operator's stored key before dispatching the outbound call. Incomplete validation logic failed to strip stored credentials when overrides appeared in nested fields, path values, or bracket-notation form data. The proxy consequently forwards its stored provider API keys to the attacker-controlled destination. The same primitive enables Server-Side Request Forgery against internal services reachable from the proxy host.

Root Cause

Request validation was implemented across litellm/proxy/auth/auth_utils.py, litellm/proxy/common_request_processing.py, litellm/proxy/health_endpoints/_health_endpoints.py, litellm/proxy/image_endpoints/endpoints.py, and litellm/proxy/litellm_pre_call_utils.py. Each location applied different checks, and none inspected every sensitive parameter across all request encodings. Nested JSON bodies, URL path parameters, and bracket-notation form fields (for example metadata[api_base]) bypassed the checks entirely.

Attack Vector

An authenticated proxy user sends a chat completion or image request containing an override such as api_base pointing at an attacker-controlled host, embedded in a nested object or bracket-notation form field. The proxy attaches its stored provider credentials and forwards the request to the attacker. The same technique targets internal endpoints (metadata services, admin APIs) reachable from the proxy network.

python

# Patch: litellm/proxy/common_request_processing.py
# Introduces reject_url_valued_destination to block user-controlled routing overrides
    ProxyConfig = _ProxyConfig
else:
    ProxyConfig = Any
-from litellm.proxy.litellm_pre_call_utils import add_litellm_data_to_request
+from litellm.proxy.litellm_pre_call_utils import (
+    add_litellm_data_to_request,
+    reject_url_valued_destination,
+)
from litellm.types.utils import ModelResponse, ModelResponseStream, Usage

Source: GitHub Commit 473f72e

python

# Patch: litellm/proxy/auth/auth_utils.py
# Adds extract_nested_form_metadata to inspect bracket-notation and nested fields
    validate_url,
)
from litellm.proxy._types import *
+from litellm.proxy.common_utils.http_parsing_utils import extract_nested_form_metadata
from litellm.types.router import CONFIGURABLE_CLIENTSIDE_AUTH_PARAMS
from litellm.types.utils import CustomPricingLiteLLMParams

Source: GitHub Commit 473f72e

Detection Methods for CVE-2026-84377

Indicators of Compromise

Outbound HTTPS connections from LiteLLM proxy hosts to domains not on the approved provider allowlist (for example, unexpected destinations receiving Authorization: Bearer headers).
Proxy request logs containing user-supplied api_base, base_url, fallbacks, or litellm_credential_name values, especially inside nested JSON or bracket-notation form fields.
Requests to internal RFC1918 addresses, cloud metadata endpoints (169.254.169.254), or localhost originating from the proxy service account.

Detection Strategies

Parse LiteLLM access logs for request bodies containing routing parameters and correlate the outbound destination with the configured provider allowlist.
Deploy egress network monitoring on proxy hosts and alert on TLS SNI values outside a known-good provider list.
Enable audit logging for authenticated proxy users and flag repeated requests carrying override parameters.

Monitoring Recommendations

Baseline the LiteLLM proxy's outbound destinations and alert on new domains or IP ranges.
Monitor for HTTP 4xx/5xx patterns following override parameters, which may indicate reconnaissance of internal services.
Rotate provider API keys and monitor upstream provider dashboards for anomalous usage from unfamiliar source IPs.

How to Mitigate CVE-2026-84377

Immediate Actions Required

Upgrade LiteLLM to version 1.88.6 or 1.96.2 (or later) as published in the vendor security advisory.
Rotate all provider API keys, credential objects, and secrets referenced by litellm_credential_name after upgrade.
Restrict proxy user permissions and review authenticated user accounts for unexpected additions.

Patch Information

The fix is delivered in LiteLLM Release v1.88.6 and LiteLLM Release v1.96.2. Technical details are in the GHSA-3cv6-jpf6-8222 Security Advisory and pull requests #36011, #36314, and #36494. The patches introduce reject_url_valued_destination and extract_nested_form_metadata to enforce consistent parameter checks across body, path, and form-encoded inputs.

Workarounds

Place the LiteLLM proxy behind an egress firewall that only permits connections to approved provider endpoints.
Deny bracket-notation form fields and nested api_base, base_url, fallbacks, model_list, and litellm_credential_name parameters at an upstream API gateway or WAF.
Disable anonymous or shared proxy user tokens and require per-user credentials with least-privilege scopes.

bash

# Upgrade LiteLLM to a fixed version
pip install --upgrade 'litellm>=1.96.2'

# Verify installed version
python -c "import litellm; print(litellm.__version__)"

# Example egress allowlist enforced via iptables (adjust to your provider set)
iptables -A OUTPUT -p tcp -d api.openai.com --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp -d api.anthropic.com --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j REJECT