Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
A GitHub-reviewed security advisory, not necessarily under active exploitation the way our CISA KEV advisories are, but a real, disclosed vulnerability in an open-source dependency.
Affected packages
Vulnerable: <= 1.83.8
Patched in 1.83.9
Details
A server-side request forgery in LiteLLM Proxy lets an authenticated caller redirect the
proxy's outbound request to a host of their choosing by smuggling an api_base inside the
user_config request body, bypassing the existing parameter guard.
LiteLLM Proxy validates request bodies with is_request_body_safe, which blocks the
api_base and base_url parameters but does not cover user_config. The user_config
object is used to build the outbound router for a request, so a caller can place an
api_base inside it and reach an arbitrary host. The guard only inspected the two
top-level keys, so the same api_base nested inside user_config was never checked.
Exploitation requires a valid virtual key.
An authenticated caller can make the proxy issue server-side requests to internal or external hosts of their choosing, reaching endpoints the caller cannot otherwise access.
Affected: <= 1.83.8
Patched: 1.83.9
Upgrade to 1.83.9 or later (released 2026-04-17).
EPSS, exploit probability
Low0.44%
estimated chance of real-world exploitation in the next 30 days, higher than 38.2% of every CVE FIRST.org scores
Refreshed 11/1/2026, via FIRST.org's EPSS model, not CVSS, this measures likelihood of exploitation, not how severe it would be.
Talk to us about this
Find out whether this dependency (or others like it) is actually reachable in your codebase.
Get help patching, or building dependency-scanning into your pipeline going forward.
A secure code review or supply chain review finds this before an advisory does.