LiteLLM: Local file read via request-supplied OIDC file references
### Impact LiteLLM's `/health/test_connection` endpoint resolved request-supplied environment and OIDC file references in `litellm_params`. A proxy administrator, or another privileged caller with permission to test model connections, could cause LiteLLM to read files from the local filesystem via an `oidc/file/` reference. Because exploitation requires privileged proxy access, this is treated as a defense-in-depth issue rather than a cross-tenant privilege bypass. ### Patches The issue is fixed in `1.83.10-stable`. LiteLLM recommend upgrading to `1.83.10-stable` or later. ### Workarounds Restrict `/health/test_connection` access to trusted administrators only.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-59819US | medium4.9 | — | ||
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.10-stable, LiteLLM's /health/test_connection endpoint resolved request-supplied… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/BerriAI/litellmPACKAGE
- https://github.com/BerriAI/litellm/pull/25592WEB
- https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stableWEB
- https://github.com/BerriAI/litellm/security/advisories/GHSA-4g5m-c9r5-49xfWEB
- https://github.com/advisories/GHSA-4g5m-c9r5-49xfADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2026-59819ADVISORY
- https://pypi.org/project/litellmPACKAGE
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan