CVE-2026-84377
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
In LiteLLM prior to versions 1.88.6 and 1.96.2, a vulnerability allowed any authenticated proxy user to redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials to that destination. Request validation in several files used incomplete checks that did not cover every sensitive parameter or inspect equivalent values across nested request fields, path values, and bracket-notation form data. Routing and credential parameters including api_base, base_url, model_list, fallbacks, and litellm_credential_name could therefore be applied without clearing the operator's stored key, exposing upstream provider credentials and other configured secrets and permitting server-side requests to internal services reachable by the proxy.
Risk Assessment
The vulnerability may lead to exposure of sensitive credentials and secrets, and may allow an attacker to access internal services, potentially resulting in confidentiality and integrity breaches.
Recommendation
It is recommended to upgrade to version 1.88.6 or 1.96.2, which fix the issue.
Other vulnerabilities in LiteLLM
See all- CVE-2026-37004Critical
BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), allowing unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.
- CVE-2026-30623Critical
LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application allows users to add MCP servers via a JSON configuration specifying arbitrary command and args values, which are executed on the host without validation. This enables attackers to run arbitrary operating system commands.
- CVE-2026-59822HighActively exploited
LiteLLM before version 1.84.0 has a vulnerability in the MCP Streamable HTTP endpoint that allows an unauthenticated attacker to bypass LiteLLM key validation using a crafted Authorization header. The attacker can exploit the OAuth2 passthrough fallback path to replace failed key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid key.
- CVE-2026-49468Critical
LiteLLM proxy before version 1.84.0 has a Host-header parsing flaw that, under specific conditions, allows unauthenticated access to protected management routes. The issue arises from a mismatch between the route evaluated by the auth layer and the route actually dispatched by FastAPI.
- CVE-2026-42271HighActively exploited
LiteLLM versions 1.74.2 through 1.83.6 have a vulnerability in the POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list endpoints, which accept a full MCP server configuration including commands to execute. An authenticated user with any API key can run arbitrary commands on the proxy host.
- CVE-2026-42208CriticalActively exploited
In LiteLLM versions from 1.81.16 to before 1.83.7, a database query used during proxy API key checks is vulnerable to SQL injection due to mixing caller-supplied key value into the query text. An unauthenticated attacker can send a crafted Authorization header to any LLM API route, leading to reading and potentially modifying data in the proxy's database.
- CVE-2026-40217High
A vulnerability in LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.
- CVE-2026-35030Critical
In LiteLLM prior to 1.83.0, when JWT authentication is enabled (enable_jwt_auth: true), the OIDC userinfo cache uses the first 20 characters of the token as the cache key. JWT tokens produced by the same signing algorithm have identical first 20 characters, allowing an unauthenticated attacker to craft a token matching the cache and inherit a legitimate user's identity and permissions.
- CVE-2026-35029High
LiteLLM before version 1.83.0 has a vulnerability where the /config/update endpoint does not enforce admin role authorization. An authenticated user can modify proxy configuration, environment variables, and register custom pass-through endpoint handlers, leading to remote code execution, arbitrary file reading, and takeover of privileged accounts.
- CVE-2026-59821High
LiteLLM prior to version 1.82.0-stable did not apply proper sandboxing and validation for Custom Code Guardrails during creation and update, allowing a privileged user to execute arbitrary Python code in the proxy environment and potentially expose process secrets.
Original NVD description (English source)
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials to that destination. Request validation in litellm/proxy/auth/auth_utils.py, litellm/proxy/common_request_processing.py, litellm/proxy/health_endpoints/_health_endpoints.py, litellm/proxy/image_endpoints/endpoints.py, and litellm/proxy/litellm_pre_call_utils.py used incomplete checks that did not cover every sensitive parameter or inspect equivalent values across nested request fields, path values, and bracket-notation form data. Routing and credential parameters including api_base, base_url, model_list, fallbacks, and litellm_credential_name could therefore be applied without clearing the operator's stored key, exposing upstream provider credentials and other configured secrets and permitting server-side requests to internal services reachable by the proxy. This issue is fixed in versions 1.88.6 and 1.96.2.