CVE-2026-84377
Received Received - Intake

Authentication Bypass in LiteLLM Proxy Server

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: GitHub, Inc.

Description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials to that destination. Request validation in litellm/proxy/auth/auth_utils.py, litellm/proxy/common_request_processing.py, litellm/proxy/health_endpoints/_health_endpoints.py, litellm/proxy/image_endpoints/endpoints.py, and litellm/proxy/litellm_pre_call_utils.py used incomplete checks that did not cover every sensitive parameter or inspect equivalent values across nested request fields, path values, and bracket-notation form data. Routing and credential parameters including api_base, base_url, model_list, fallbacks, and litellm_credential_name could therefore be applied without clearing the operator's stored key, exposing upstream provider credentials and other configured secrets and permitting server-side requests to internal services reachable by the proxy. This issue is fixed in versions 1.88.6 and 1.96.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84377
EUVD
EUVD-2026-70236

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
litellm litellm to 1.96.2 (exc)
berriai litellm to 1.88.6 (inc)
berriai litellm to 1.96.2 (inc)
berriai litellm to 1.94.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-84377 is a security flaw in LiteLLM, an AI proxy server, where incomplete request-parameter validation allowed authenticated users to bypass security checks. The vulnerability enabled attackers to redirect outbound provider calls to controlled destinations, causing the proxy to send stored provider credentials to those destinations. This exposed sensitive secrets and permitted server-side requests to internal services.

Detection Guidance

To detect this vulnerability, monitor for unusual outbound requests from your LiteLLM proxy to unexpected destinations. Check logs for parameters like api_base, base_url, model_list, or litellm_credential_name being overridden in requests. Use network monitoring tools to identify SSRF attempts or credential exfiltration to unauthorized endpoints.

Impact Analysis

This vulnerability allows attackers to exfiltrate your proxy's configured provider credentials, including API keys and other secrets. It also enables Server-Side Request Forgery (SSRF) attacks against internal services accessible by the proxy. The impact includes potential data breaches, unauthorized access to internal systems, and loss of confidential information.

Compliance Impact

This vulnerability can lead to non-compliance with GDPR and HIPAA due to unauthorized exposure of sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguarding protected health information. A breach via this vulnerability could result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade LiteLLM to versions 1.88.6 or 1.96.2 or later. Disable client-side credential overrides by setting general_settings.allow_client_side_credentials to false. Restrict proxy keys to trusted users only. Block sensitive parameters like api_base at a reverse proxy or API gateway level.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84377. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart