Update dependency litellm to v1.94.3 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
litellm	==1.94.0 → ==1.94.3

---

LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters

CVE-2026-84377 / GHSA-3cv6-jpf6-8222

More information

Details

Impact

Any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination they control and cause the proxy to send its own configured provider credentials to that destination. The proxy's request-body validation was a denylist that did not cover every sensitive parameter and did not inspect parameters nested inside other request fields, so a caller could supply a routing or credential value that the proxy applied without clearing the operator's stored key. Any authenticated user could therefore exfiltrate the operator's upstream provider credentials and other configured secrets, and perform Server-Side Request Forgery against internal services reachable from the proxy.

Patches

Fixed in 1.96.2, 1.95.1, 1.94.3, 1.93.2, 1.92.2, 1.91.5, 1.90.7, 1.89.7, and 1.88.6.

Workarounds

Set general_settings.allow_client_side_credentials to false so callers cannot override connection parameters, restrict proxy keys to trusted callers, and block the affected parameters (api_base, base_url, model_list, fallbacks, provider credential fields) at a reverse proxy or API gateway.

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/BerriAI/litellm/security/advisories/GHSA-3cv6-jpf6-8222
• https://nvd.nist.gov/vuln/detail/CVE-2026-84377
• https://github.com/BerriAI/litellm/pull/36011
• https://github.com/BerriAI/litellm/pull/36314
• https://github.com/BerriAI/litellm/pull/36494
• https://github.com/BerriAI/litellm/commit/473f72e63a9777d793fbbf57194d8ec4fb97bc1b
• https://github.com/BerriAI/litellm/commit/820f247a6abba55cd87d130bef7bba7be3b29d37
• https://github.com/BerriAI/litellm/commit/c898d341c02299cf2506d0d8e84cc67953043593
• https://github.com/advisories/GHSA-3cv6-jpf6-8222

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

BerriAI/litellm (litellm)

v1.94.3

Compare Source

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.94.3

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.94.3/cosign.pub \
  ghcr.io/berriai/litellm:v1.94.3

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

---

What's Changed

• chore(release): backport #​34189, #​36011 to stable/1.94.x and cut 1.94.3 by @​yuneng-berri in #​36317

Full Changelog: BerriAI/litellm@v1.94.2...v1.94.3

v1.94.2

Compare Source

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.94.2

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.94.2/cosign.pub \
  ghcr.io/berriai/litellm:v1.94.2

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

---

What's Changed

• chore(release): backport #​35835, #​35844 to stable/1.94.x and cut 1.94.2 by @​yuneng-berri in #​36237

Full Changelog: BerriAI/litellm@v1.94.1...v1.94.2

v1.94.1

Compare Source

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.94.1

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.94.1/cosign.pub \
  ghcr.io/berriai/litellm:v1.94.1

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

---

What's Changed

• chore(release): backport #​35271 to stable/1.94.x and cut 1.94.1 by @​yuneng-berri in #​35277

Full Changelog: BerriAI/litellm@v1.94.0...v1.94.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.