LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`
LiteLLM
More for LiteLLM RSS feed for LiteLLM
- Severity
- High, CVSS 8.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Record
- GHSA-g5ff-637f-6q2m
- Affects
- LiteLLM
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- October 27, 2026
- Source last modified
- October 27, 2026
Description
Summary
An authenticated LiteLLM proxy user could read arbitrary local files from the proxy runtime by sending a crafted vertex_ai_credentials value to /utils/transform_request. The request-body safety blocklist rejected vertex_credentials but missed its alias vertex_ai_credentials, which let the value reach the Vertex AI credential loader and trigger a file read that is sent to an attacker-controlled URL.
Impact
A low-privilege authenticated user (only internal_user_viewer, obtainable through SSO login on many deployments) could read any file readable by the LiteLLM process. Reading files such as /proc/self/environ can disclose LITELLM_MASTER_KEY and provider API keys, so the impact can escalate to full proxy-admin control.
Remediation
Upgrade to 1.95.0 or later. The fix adds the missing alias to the request-body blocklist, so no configuration change is needed once you upgrade. There is no reliable configuration workaround on affected versions.
Description quoted from the GitHub Advisory Database.
Who is affected
LiteLLM, made by BerriAI, is a service that sits between your organization's apps and AI language model providers and passes requests along to them. This flaw affects versions before 1.95.0. Anyone who can sign in to LiteLLM, even with the lowest viewer-level account (which on many setups comes with a normal single sign-on login), could read any file on the server that LiteLLM itself can read. That can expose the main admin key and the keys for your AI provider accounts, letting the attacker take full admin control of LiteLLM. This flaw is rated High.
What to do
- The person who installed or runs LiteLLM for your organization should upgrade it to
1.95.0or later. - No configuration change is needed once you upgrade, because the update itself closes the gap.
- There is no reliable setting change that protects versions before
1.95.0, so do not wait on a workaround: plan the upgrade as soon as you can. - If an IT provider or vendor runs LiteLLM for your organization, send them this advisory and ask when the update will be done.
Analysis written from the source record as of October 27, 2026 and reviewed before publishing.