## Summary

The `litellm.pass_through` module exposes a dynamic pass-through endpoint that proxies arbitrary HTTP requests to user-supplied URLs without proper server-side request forgery (SSRF) validation. An attacker can craft requests to access internal services (cloud metadata endpoints like `169.254.169.254`, internal APIs, localhost services) through the LiteLLM proxy.

A separate Security Advisory (GHSA) is being filed for this vulnerability.

## Vulnerability Details

The pass-through functionality in `litellm.pass_through`: 1. Accepts a user-provided URL/endpoint parameter 2. Constructs an HTTP request to the target 3. Forwards the request **without checking against an SSRF blocklist** 4. Returns the response to the caller

Unlike the main model proxy endpoints which have guardrail checks, the pass-through module operates as a raw HTTP relay with no destination validation.

## Proof of Concept

```python import requests

# LiteLLM instance running at localhost:4000 LITELLM_URL = "http://localhost:4000" API_KEY = "sk-any-valid-key"

# Access AWS metadata via pass-through (SSRF) response = requests.post( f"{LITELLM_URL}/pass_through", headers={"Authorization": f"Bear…