HighVulnerabilityLLM-specific

CVE-2026-59823: LiteLLM Proxy server-side request forgery through user_config api_base

Source: NVD(opens in a new tab)
Identifier: CVE-2026-59823
Published: September 16, 2026
Record updated: October 13, 2026

Affected: litellm <= 1.83.8
Fixed in: 1.83.9
released April 16, 2026, 152 days before disclosure
Known exploitation: Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS: 0.4%

Summary

LiteLLM, an AI Gateway proxy for calling LLM APIs, is affected before version 1.83.9. An authenticated caller holding a valid virtual key can nest api_base inside the user_config request body, which bypasses is_request_body_safe because that check blocks only top-level api_base and base_url. Since user_config builds the outbound router, the caller can redirect server-side requests to an internal or external host of their choosing and reach endpoints they could not otherwise access.

Mitigation

Fixed in 1.83.9.

Details

Scores and exploitation

Patch available: Yes
EPSS: 0.4%Estimated probability that this CVE is exploited in the next 30 days, from the FIRST Exploit Prediction Scoring System. Read on November 3, 2026.
Disclosure date: September 16, 2026

Weaknesses and techniques

Weakness (CWE): CWE-918
Attack pattern (CAPEC): CAPEC-664
AI threat technique (MITRE ATLAS): AML.T0010

Affected

Packages: litellm@<= 1.83.8 (fixed: 1.83.9)

Classification

Attack type: Supply chain,
Other
Attack sophistication: Moderate
AI component targeted: API
Impact: Confidentiality,
Integrity
Labels: security

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative. The source gives this advisory a description and no title, so the title above is a headline generated from the source text.

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-59823

First tracked: September 16, 2026 at 08:07 PM ET, from NVD/CVE Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 95% (self-assessed)

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

litellmPyPILLM dependency since 2023-07-27 · 55 tracked dependents

Coverage

News, research and other items that mention CVE-2026-59823.

When LLM Gateways Go Wrong: Findings from LiteLLMCheck Point Research · 2026-10-13

Summary

Mitigation

Affected packages in the Exposure Registry

Coverage

Related items