AI Threat Alert
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.9, an authenticated LiteLLM Proxy caller with a valid virtual key can place api_base inside the user_config request body to bypass is_request_body_safe, which blocks top-level api_base and base_url...
Full CISO analysis pending enrichment.
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| LiteLLM | pip | <= 1.83.8 | 1.83.9 |
Do you use LiteLLM? You're affected.
How severe is it?
What should I do?
Patch available
Update LiteLLM to version 1.83.9
Which compliance frameworks are affected?
Compliance analysis pending. Sign in for full compliance mapping when available.
Frequently Asked Questions
What is CVE-2026-59823?
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.9, an authenticated LiteLLM Proxy caller with a valid virtual key can place api_base inside the user_config request body to bypass is_request_body_safe, which blocks top-level api_base and base_url but previously did not inspect or reject user_config. Because user_config constructs the outbound router, the nested destination redirects a server-side request to an internal or external host selected by the caller and can expose endpoints the caller cannot otherwise access. This issue is fixed in version 1.83.9.
Is CVE-2026-59823 actively exploited?
No confirmed active exploitation of CVE-2026-59823 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-59823?
Update to patched version: LiteLLM 1.83.9.
What is the CVSS score for CVE-2026-59823?
No CVSS score has been assigned yet.
What are the technical details?
Original Advisory
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.9, an authenticated LiteLLM Proxy caller with a valid virtual key can place api_base inside the user_config request body to bypass is_request_body_safe, which blocks top-level api_base and base_url but previously did not inspect or reject user_config. Because user_config constructs the outbound router, the nested destination redirects a server-side request to an internal or external host selected by the caller and can expose endpoints the caller cannot otherwise access. This issue is fixed in version 1.83.9.
Weaknesses (CWE)
CWE-918 Server-Side Request Forgery (SSRF)
Primary
CWE-918 Server-Side Request Forgery (SSRF)
Primary
CWE-918 Server-Side Request Forgery (SSRF) CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Source: MITRE CWE corpus.
References
Timeline
Related Vulnerabilities
CVE-2026-30623 9.8 LiteLLM: RCE via unsanitized MCP server config
Same package: litellm CVE-2026-37004 9.8 LiteLLM: unauth SSTI in /prompts/test enables RCE
Same package: litellm CVE-2026-42208 9.8 LiteLLM: SQL injection exposes LLM API credentials
Same package: litellm CVE-2026-54352 9.6 Budibase: zip symlink bypass exposes all server secrets
Same package: litellm CVE-2026-35030 9.1 LiteLLM: auth bypass via JWT cache key collision
Same package: litellm