What happened
Published Sept 2, 2026, this CVSS 6.5 flaw allows any authenticated (even low-privilege) LiteLLM proxy user to redirect outbound model-provider calls to an attacker-controlled endpoint, leaking the proxy's centrally-configured provider credentials.
Why it matters
LiteLLM proxies commonly centralize API keys for multiple frontier model providers on behalf of many internal users; a low-privilege authenticated user being able to exfiltrate those shared credentials undermines the core security value of using a gateway/proxy pattern for AI access.
Attack vector
Any authenticated LiteLLM proxy user can redirect an outbound provider API call to a destination they control by manipulating request-body routing parameters, causing the proxy to send its configured upstream provider credentials and other configured secrets to the attacker-controlled destination.
Affected systems
LiteLLM proxy prior to versions 1.88.6 and 1.96.2
Mitigation
Upgrade to LiteLLM 1.88.6 or 1.96.2 or later per vendor commit 473f72e63a9777d793fbbf57194d8ec4fb97bc1b.