PyPI/litellm CVE-2026-59823: medium 5.3, EPSS 0.44%

LiteLLM Proxy has server-side request forgery via the `user_config` request parameter

Action: Upgrade litellm to 1.83.9 or later.

pip install litellm==1.83.9

Affected

Fixed versions

Sources

• osv: GHSA-hx8v-g79f-8w5f
• nvd: CVE-2026-59823
• https://github.com/BerriAI/litellm/security/advisories/GHSA-hx8v-g79f-8w5f
• https://github.com/BerriAI/litellm/pull/25827
• https://github.com/BerriAI/litellm/commit/47214be317f45a2d2ac08258362e0481411eb427
• https://github.com/BerriAI/litellm

CVE-2026-59823 · published 2026-09-17T14:51:21Z · modified 2026-10-01T17:55:42.736980330Z · JSON