| Component | LiteLLM |
| Severity | medium (CVSS 5.3) |
| CVSS vector | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| Published (NVD) | 2026-09-16 |
| Last modified | 2026-09-30 |
| Affected versions | < 1.83.9 read from the advisory text: NVD has not published CPE data yet |
| Fixed in | 1.83.9 |
| Weakness | CWE-918 |
| CISA KEV | not listed |
NVD description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.9, an authenticated LiteLLM Proxy caller with a valid virtual key can place api_base inside the user_config request body to bypass is_request_body_safe, which blocks top-level api_base and base_url but previously did not inspect or reject user_config. Because user_config constructs the outbound router, the nested destination redirects a server-side request to an internal or external host selected by the caller and can expose endpoints the caller cannot otherwise access. This issue is fixed in version 1.83.9.
What to do
- Upgrade LiteLLM to
1.83.9or later. - Do not expose the component's API or UI to the internet without authentication in front of it.
Sources
- NVD: CVE-2026-59823
- https://github.com/BerriAI/litellm/commit/47214be317f45a2d2ac08258362e0481411eb427
- https://github.com/BerriAI/litellm/pull/25827
- https://github.com/BerriAI/litellm/security/advisories/GHSA-hx8v-g79f-8w5f
Read more
Other LiteLLM CVEs
A vulnerability has been found in BerriAI LiteLLM up to 1.94.0. This affects the function get_secret of the file secret_managers/main.py of...
A flaw has been found in BerriAI LiteLLM up to 1.95.0. Affected by this issue is the function ui_view_session_spend_logs of the file litellm...
LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to au...
BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated u...
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.2, any authenticated...
BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute ar...