CVE-2026-84377 BerriAI CVE debrief

Who should care

Users and administrators of LiteLLM proxy servers, particularly those with multi-user environments or integrations with external services, should review and apply available patches to address the vulnerability. They should also restrict access to the LiteLLM proxy server to only trusted users and networks, monitor outbound provider calls and credentials usage to detect potential exploitation attempts, and implement additional security controls such as authentication and authorization for outbound provider calls. System administrators and security teams overseeing AI Gateway deployments need to prioritize patching and vulnerability management for LiteLLM proxy servers to prevent potential credential exposure and unauthorized access to sensitive data and services. This includes reviewing current configurations, updating to the latest versions, and ensuring proper security measures are in place to protect against exploitation attempts. Additionally, developers and DevOps teams responsible for maintaining and securing AI infrastructure should be aware of the vulnerability and take proactive steps to mitigate risks associated with the LiteLLM proxy server vulnerability. This involves staying informed about security advisories, regularly updating dependencies, and implementing robust security practices to safeguard against potential threats. By taking these steps, organizations can reduce the risk of exploitation and protect their AI Gateway deployments from potential attacks. Furthermore, security researchers and vulnerability management teams should be aware of the vulnerability and its potential impact on AI Gateway deployments. They should monitor for exploitation attempts and provide guidance to affected organizations on mitigation and remediation strategies. By working together, we can minimize the risk of exploitation and ensure the security and integrity of AI Gateway deployments. It is also essential for organizations to have incident response plans in place in case of a potential security breach. This includes having a clear understanding of the vulnerability, its impact, and the necessary steps to take in case of an attack. By being proactive and prepared,

Technical summary

The LiteLLM proxy server is vulnerable to a request validation issue that allows authenticated users to redirect outbound provider calls to a controlled destination. This could potentially expose upstream provider credentials and other configured secrets. The issue arises from incomplete checks in various modules including auth_utils.py, common_request_processing.py, health_endpoints.py, image_endpoints.py, and litellm_pre_call_utils.py. Affected parameters include api_base, base_url, model_list, fallbacks, and litellm_credential_name. The vulnerability is addressed in versions 1.88.6 and 1.96.2 through enhanced validation and routing checks.

Defensive priority

Authenticated users with access to the LiteLLM proxy server may be able to redirect outbound provider calls to a controlled destination, potentially exposing upstream provider credentials and other configured secrets.

Recommended defensive actions

• Review and apply available patches (versions 1.88.6 and 1.96.2) to address the vulnerability in LiteLLM proxy server.
• Restrict access to the LiteLLM proxy server to only trusted users and networks.
• Monitor outbound provider calls and credentials usage to detect potential exploitation attempts.
• Implement additional security controls, such as authentication and authorization, for outbound provider calls.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record indicates that LiteLLM proxy users could redirect outbound provider calls to a controlled destination due to incomplete request validation, potentially exposing credentials and secrets. Fixes are available in versions 1.88.6 and 1.96.2.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.