LiteLLM is a proxy server that calls LLM APIs in OpenAI or native format. Before version 1.83.9, an authenticated caller with a valid virtual key could place an api_base parameter inside the user_config request body. This bypassed the is_request_body_safe check, which blocks top-level api_base and base_url but did not inspect user_config. Since user_config constructs the outbound router, this allowed the attacker to redirect server-side requests to arbitrary internal or external hosts, potentially exposing otherwise inaccessible endpoints. The issue is resolved in version 1.83.9.

An authenticated user with a valid virtual key can exploit this SSRF vulnerability to make the server send requests to arbitrary internal or external destinations. This may allow access to sensitive internal endpoints or external resources that are not normally accessible to the caller. The vulnerability does not require user interaction and has low complexity but requires authentication with a virtual key.

Upgrade to LiteLLM version 1.83.9 or later, where this SSRF vulnerability is fixed. No other mitigation is indicated or required as the fix addresses the root cause by properly validating the user_config parameter.