{"data":{"id":"79143417-530a-4468-b06d-98fcf29ca0f6","title":"CVE-2024-6587: A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10. This vulnerability allows…","summary":"CVE-2024-6587 is a Server-Side Request Forgery (SSRF) flaw in berriai/litellm version 1.38.10. Users can set the `api_base` parameter on requests to `POST /chat/completions`, and the application then sends the request, including the OpenAI API key, to the domain that `api_base` specifies. A malicious user can point `api_base` at their own domain and intercept the OpenAI API key, which enables unauthorized access and potential misuse of the API key.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-6587","publishedAt":"2024-09-13T20:15:04.637Z","cveId":"CVE-2024-6587","cweIds":["CWE-918"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["litellm@< 1.44.8 (fixed: 1.44.8)"],"affectedPackageNames":["litellm"],"affectedPackageRefs":["pypi:litellm"],"affectedVendors":[],"affectedVendorsRaw":["LiteLLM"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"litellm server-side request forgery through api_base in chat completions","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.34375,"epssCheckedAt":"2026-11-04T12:08:33.434Z","kevDateAdded":null,"advisoryAliases":["GHSA-g26j-5385-hhw3"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:55:16.066Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":"2026-10-29T21:45:31.315Z","capecIds":["CAPEC-664"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"litellm","fixedVersion":"1.44.8","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":"ecosystem","source":"tracked","status":"version_not_found","checkedAt":"2026-10-29T21:45:31.163Z"}]}}