## 🚨 Security Vulnerability: Guardrail SSRF

LiteLLM provides `validate_url()` / `safe_get()` / `async_safe_get()` in `litellm_core_utils/url_utils.py` for SSRF-protected HTTP requests. However, the **custom code guardrail `http_request()` primitive** introduced for the Guardrail feature bypasses all SSRF protection entirely.

**CVSS: 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)** **Affected:** All versions with guardrails enabled (confirmed in 1.86.2) **Ecosystem:** pip **Package:** litellm

## Vulnerability Details

### The Guardrail http_request() (VULNERABLE PATH)

File: `litellm/proxy/guardrails/guardrail_hooks/custom_code/primitives.py`

```python async def http_request( url: str, method: str = "GET", headers: Optional[Dict[str, str]] = None, body: Optional[Any] = None, timeout: Optional[float] = None, ) -> Dict[str, Any]: # Validate URL — ONLY checks URL syntax (scheme + netloc) if not is_valid_url(url): return _http_error_response(f"Invalid URL: {url}")

# Uses the global async HTTP client DIRECTLY — no SSRF validation client = get_async_httpx_client( llm_provider=httpxSpecialProvider.GuardrailCallback, params={"tim…