LiteLLM let signed-in users send the proxy's API keys elsewhere

What happened

Any authenticated user of a LiteLLM proxy before 1.88.6 and 1.96.2 could point an outbound model call at a server they controlled, and the proxy sent its configured provider credentials there. LiteLLM's request validation missed routing and credential parameters such as api_base, base_url, model_list, fallbacks and litellm_credential_name when they arrived in nested fields, path values or bracket-notation form data. The CVE record of 2 September 2026 scores it CVSS 3.1 6.5.

LiteLLM's advisory GHSA-3cv6-jpf6-8222 names 1.88.6 and 1.96.2 as the fixed releases. A separate LiteLLM flaw published on 28 September, CVE-2026-93355, lets one login token take over another user's account and is listed on its own row.