CVE-2026-59823

LiteLLM Proxy versions before 1.83.9 let an authenticated caller who already has a valid virtual key bypass request-body checks by nesting api_base inside user_config. The check is_request_body_safe blocked top-level api_base and base_url but did not inspect or reject that nested field. Because user_config builds the outbound router, the proxy then makes a server-side request to an internal or external host chosen by the caller, which can reveal endpoints the caller could not reach directly (CWE-918). Organizations running a LiteLLM AI gateway on those versions are affected. It is fixed in 1.83.9; it is not listed in CISA KEV and no public proof-of-concept is known.

What to do: Upgrade the LiteLLM Proxy to 1.83.9 or later. Until then, restrict who can hold virtual keys, limit the proxy's network reach to internal services, and review logs for user_config values that set api_base or similar outbound destinations.