CVE-2026-59823

LiteLLM is a proxy server (AI Gateway) for calling LLM APIs. Prior to version 1.83.9 , an authenticated caller holding a valid virtual key could place api_base inside the user_config request body, bypassing the is_request_body_safe check that blocks top-level api_base and base_url but did not ins...

CVE-2026-59823 LiteLLM: Server-side request forgery via the `user_config` request parameter in LiteLLM Proxy

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to 1.83.9, an authenticated LiteLLM Proxy caller with a valid virtual key can place apibase inside the userconfig request body to bypass isrequestbodysafe, which blocks top-level apibase and baseurl but...