GHSA-g5ff-637f-6q2m
LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`
Summary
An authenticated LiteLLM proxy user could read arbitrary local files from the proxy runtime by sending a crafted vertex_ai_credentials value to /utils/transform_request. The request-body safety blocklist rejected vertex_credentials but missed its alias vertex_ai_credentials, which let the value reach the Vertex AI credential loader and trigger a file read that is sent to an attacker-controlled URL.
Impact
A low-privilege authenticated user (only internal_user_viewer, obtainable through SSO login on many deployments) could read any file readable by the LiteLLM process. Reading files such as /proc/self/environ can disclose LITELLM_MASTER_KEY and provider API keys, so the impact can escalate to full proxy-admin control.
Remediation
Upgrade to 1.95.0 or later. The fix adds the missing alias to the request-body blocklist, so no configuration change is needed once you upgrade. There is no reliable configuration workaround on affected versions.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
What each source reports
GitHub Advisories Score used
LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`
Summary
An authenticated LiteLLM proxy user could read arbitrary local files from the proxy runtime by sending a crafted vertex_ai_credentials value to /utils/transform_request. The request-body safety blocklist rejected vertex_credentials but missed its alias vertex_ai_credentials, which let the value reach the Vertex AI credential loader and trigger a file read that is sent to an attacker-controlled URL.
Impact
A low-privilege authenticated user (only internal_user_viewer, obtainable through SSO login on many deployments) could read any file readable by the LiteLLM process. Reading files such as /proc/self/environ can disclose LITELLM_MASTER_KEY and provider API keys, so the impact can escalate to full proxy-admin control.
Remediation
Upgrade to 1.95.0 or later. The fix adds the missing alias to the request-body blocklist, so no configuration change is needed once you upgrade. There is no reliable configuration workaround on affected versions.
- Record
GHSA-g5ff-637f-6q2m- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-20, CWE-22
- Updated
- 2026-11-02
OSV
LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`
Summary
An authenticated LiteLLM proxy user could read arbitrary local files from the proxy runtime by sending a crafted vertex_ai_credentials value to /utils/transform_request. The request-body safety blocklist rejected vertex_credentials but missed its alias vertex_ai_credentials, which let the value reach the Vertex AI credential loader and trigger a file read that is sent to an attacker-controlled URL.
Impact
A low-privilege authenticated user (only internal_user_viewer, obtainable through SSO login on many deployments) could read any file readable by the LiteLLM process. Reading files such as /proc/self/environ can disclose LITELLM_MASTER_KEY and provider API keys, so the impact can escalate to full proxy-admin control.
Remediation
Upgrade to 1.95.0 or later. The fix adds the missing alias to the request-body blocklist, so no configuration change is needed once you upgrade. There is no reliable configuration workaround on affected versions.
- Record
GHSA-g5ff-637f-6q2m- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-20, CWE-22
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
litellmPyPI | before 1.95.0 | 1.95.0 |
litellmPyPI | before 1.95.0, plus listed versions 0.1.00.1.10.1.20.1.2010.1.202 Show 45 moreShow less0.1.2030.1.2040.1.2050.1.2060.1.2070.1.2080.1.2090.1.2100.1.2110.1.2120.1.2130.1.2140.1.2150.1.2160.1.2170.1.2180.1.2190.1.2200.1.2210.1.2220.1.2230.1.2240.1.2250.1.2260.1.2270.1.2280.1.2290.1.22910.1.2300.1.2310.1.2320.1.2330.1.2340.1.2350.1.2360.1.2370.1.2380.1.30.1.310.1.320.1.3300.1.3310.1.340.1.3410.1.343 | 1.95.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-g5ff-637f-6q2m is a high vulnerability (CVSS 8.1) in litellm, published October 27, 2026. No source lists public exploit code. Fixed in litellm 1.95.0.
References
Left out here: 802 versions. The JSON record has them.