Arbitrary local file read in LiteLLM via vertex_ai_credentials
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
LiteLLM before 1.95.0 lets an authenticated user with only the internal_user_viewer role read arbitrary files that the proxy process can read. A request-body blocklist rejects vertex_credentials but misses its alias vertex_ai_credentials, so a crafted value reaches the Vertex AI credential loader, reads a local file (CWE-22) and sends its contents to an attacker-controlled URL. Reading files such as /proc/self/environ can expose the LiteLLM master key and provider API keys.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the GitHub advisory
## Summary An authenticated LiteLLM proxy user could read arbitrary local files from the proxy runtime by sending a crafted `vertex_ai_credentials` value to `/utils/transform_request`. The request-body safety blocklist rejected `vertex_credentials` but missed its alias `vertex_ai_credentials`, which let the value reach the Vertex AI credential loader and trigger a file read that is sent to an attacker-controlled URL. ## Impact A low-privilege authenticated user (only `internal_user_viewer`, obtainable through SSO login on many deployments) could read any file readable by the LiteLLM process. Reading files such as `/proc/self/environ` can disclose `LITELLM_MASTER_KEY` and provider API keys, so the impact can escalate to full proxy-admin control. ## Remediation Upgrade to `1.95.0` or later. The fix adds the missing alias to the request-body blocklist, so no configuration change is needed once you upgrade. There is no reliable configuration workaround on affected versions.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | litellm (PyPI) | before 1.95.0 | 1.95.0 | Patch available | GHSA-g5ff-637f-6q2m |
- litellm (PyPI) Vendor— Affected before 1.95.0 Fixed in 1.95.0 Patch available GHSA-g5ff-637f-6q2m
Remediation
Upgrade litellm to 1.95.0 or later, which adds the missing alias to the request-body blocklist, so no configuration change is needed. The advisory states that no reliable configuration workaround exists on affected versions.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · GHSA-g5ff-637f-6q2m litellm (PyPI) Fixed in 1.95.0 Advisory →
Timeline
- 2026-10-27 Threatist record created from GHSA-g5ff-637f-6q2m
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences