GHSA-g5ff-637f-6q2m
LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`
- Risk score
- 54/100
- CVSS
- 8.1 v3.1
- Published
- 27 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- An authenticated LiteLLM proxy user could read arbitrary local files from the proxy runtime by sending a crafted vertex_ai_credentials value to /utils/transform_request. The request-body safety blocklist rejected vertex_credentials but missed its alias vertex_ai_credentials, which let the value reach the Vertex AI cre…
- Affected
- litellm (pip) < 1.95.0
- Fix
- Upgrade litellm to 1.95.0 or later.
- Exploitation
- No known exploitation
Story map
At a glance
litellm: Amber, patch this week. A privilege escalation vulnerability in LiteLLM proxy server allows an authenticated internal user to gain administrative access and execute arbitrary commands. An attacker could exploit this by replaying a forged administrator credential as a bearer token.
The flaws
- GHSA-g5ff-637f-6q2m: LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials` (CVSS 8.1)
- CVE-2026-114612: LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key (CVSS 9.9 · EPSS 0%)
- CVE-2026-84377: LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters (CVSS 6.5 · EPSS 1%)
- GHSA-hhww-mrg2-969h: LiteLLM vulnerable to reflected XSS in /sso/debug/callback (CVSS 6.8)
The fix
Upgrade litellm: 1.96.2 · 1.95.1 · 1.94.3 · 1.93.2 · 1.92.2 · 1.91.5 or later on your release line
Who is exposed: {'products': ['LiteLLM'], 'packages': [{'ecosystem': 'pip', 'name': 'litellm', 'vulnerable': '>= 1.91.0, < 1.100.4', 'patched': '1.100.4'}, {'ecosystem': 'pip', 'name': 'litellm', 'vulnerable': '>= 1.101.0, < 1.101.3', 'patched': '1.101.3'}, {'ecosystem': 'pip', 'name': 'litellm', 'vulnerable': '>= 1.102.0, < 1.102.2'…
Where it stands
- No known exploitation
Connects to
- Same weakness: Path traversal (CWE-22). 399 other warnings in 30 days
Why it is Yellow
- CVSS 8.1 high
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| litellm | pip | < 1.95.0 | 1.95.0 |
References
- https://github.com/advisories/GHSA-g5ff-637f-6q2m
- https://github.com/BerriAI/litellm/security/advisories/GHSA-g5ff-637f-6q2m
- https://github.com/BerriAI/litellm/pull/34189
- https://github.com/BerriAI/litellm/commit/065faf6e695be64a1a367601271839914e4a6621
- https://github.com/BerriAI/litellm/releases/tag/v1.95.0
- https://github.com/advisories/GHSA-g5ff-637f-6q2m
Original description
## Summary An authenticated LiteLLM proxy user could read arbitrary local files from the proxy runtime by sending a crafted `vertex_ai_credentials` value to `/utils/transform_request`. The request-body safety blocklist rejected `vertex_credentials` but missed its alias `vertex_ai_credentials`, which let the value reach the Vertex AI credential loader and trigger a file read that is sent to an attacker-controlled URL. ## Impact A low-privilege authenticated user (only `internal_user_viewer`, obtainable through SSO login on many deployments) could read any file readable by the LiteLLM process. Reading files such as `/proc/self/environ` can disclose `LITELLM_MASTER_KEY` and provider API keys, so the impact can escalate to full proxy-admin control. ## Remediation Upgrade to `1.95.0` or later. The fix adds the missing alias to the request-body blocklist, so no configuration change is needed once you upgrade. There is no reliable configuration workaround on affected versions.
Last activity 27 Oct 2026. Patch Forecast updates every hour.