What happened
NVD published this CVSS 5.3 finding on Sept 16, 2026 describing a validation-bypass in LiteLLM's request-safety filter that allows authenticated proxy callers to redirect outbound LLM API calls via a nested config field the filter does not check.
Why it matters
LiteLLM is a widely-adopted open-source AI gateway sitting in front of production LLM traffic for many organizations; a bypass that lets any valid virtual-key holder redirect outbound API calls (and potentially provider credentials attached to those calls) to attacker infrastructure is a credential-exfiltration and SSRF-adjacent risk in a component that centralizes access to every configured LLM provider.
Attack vector
An authenticated caller with a valid virtual key nests an api_base value inside the user_config request body field, bypassing the is_request_body_safe check that only blocks top-level api_base/base_url fields, allowing the caller to redirect LLM API traffic (and any embedded provider credentials) to an attacker-controlled endpoint.
Affected systems
LiteLLM (BerriAI/litellm) < 1.83.9
Mitigation
Upgrade to LiteLLM >= 1.83.9; audit is_request_body_safe-style validation logic for nested-field bypasses.