CVE-2026-84377

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials to that destination. Request validation in litellm/proxy/auth/auth_utils.py, litellm/proxy/common_request_processing.py, litellm/proxy/health_endpoints/_health_endpoints.py, litellm/proxy/image_endpoints/endpoints.py, and litellm/proxy/litellm_pre_call_utils.py used incomplete checks that did not cover every sensitive parameter or inspect equivalent values across nested request fields, path values, and bracket-notation form data. Routing and credential parameters including api_base, base_url, model_list, fallbacks, and litellm_credential_name could therefore be applied without clearing the operator's stored key, exposing upstream provider credentials and other configured secrets and permitting server-side requests to internal services reachable by the proxy. This issue is fixed in versions 1.88.6 and 1.96.2.

• CWE-918

• https://github.com/BerriAI/litellm/commit/473f72e63a9777d793fbbf57194d8ec4fb97bc1b
• https://github.com/BerriAI/litellm/commit/820f247a6abba55cd87d130bef7bba7be3b29d37
• https://github.com/BerriAI/litellm/commit/c898d341c02299cf2506d0d8e84cc67953043593
• https://github.com/BerriAI/litellm/pull/36011
• https://github.com/BerriAI/litellm/pull/36314
• https://github.com/BerriAI/litellm/pull/36494
• https://github.com/BerriAI/litellm/releases/tag/v1.88.6
• https://github.com/BerriAI/litellm/releases/tag/v1.96.2
• https://github.com/BerriAI/litellm/security/advisories/GHSA-3cv6-jpf6-8222

Published

Sep 2, 2026

Last Modified

Sep 9, 2026

Status

Awaiting Analysis

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-84371ApostropheCMS is an open-source Node.js content management s…5.4
• CVE-2026-84372Predis is a flexible and feature-complete Redis and Valkey c…9.8
• CVE-2026-84373Vitest is a testing framework powered by Vite. From 2.1.0 un…5.9
• CVE-2026-84374Laravel Excel provides supercharged Excel exports and import…7.5
• CVE-2026-84375js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 u…7.5
• CVE-2026-84376Astro is a web framework for content-driven websites. Prior …6.3
• CVE-2026-84378HTTPX2 is a next generation HTTP client for Python. From 2.5…5.9
• CVE-2026-84379HTTPX2 is a next generation HTTP client for Python. Prior to…5.3
• CVE-2026-8438The All-In-One Security (AIOS) – Security and Firewall plugi…7.2
• CVE-2026-84380HTTPX2 is a next generation HTTP client for Python. Prior to…5.6
• CVE-2026-84381HTTPX2 is a next generation HTTP client for Python. Prior to…8.1
• CVE-2026-84382HTTPX2 is a next generation HTTP client for Python. Prior to…7.5