CVE-2026-59819
mediumpriority · track · 20EPSS 0.006 · 47 %ileDEEUUSEPSS · scored 2026-10-26
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.10-stable, LiteLLM's /health/test_connection endpoint resolved request-supplied environment and OIDC file references in litellm_params, allowing a proxy administrator or another privileged caller with permission to test model connections to read files from the local filesystem via an oidc/file/ reference. This issue is fixed in version 1.83.10-stable.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 0.5–4.9
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (7)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-2263LiteLLM: Mehrere SchwachstellenDeutsch2026-07-08csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in LiteLLM ausnutzen, um Informationen offenzulegen, Daten zu manipulieren, Code auszuführen und um Sicherheitsmaßnahmen zu umgehen.
- GHSA-4g5m-c9r5-49xfLiteLLM: Local file read via request-supplied OIDC file references2026-07-22ghsa · osvUS
### Impact LiteLLM's `/health/test_connection` endpoint resolved request-supplied environment and OIDC file references in `litellm_params`. A proxy administrator, or another privileged caller with permission to test model connections, could cause LiteLLM to read files from the local filesystem via an `oidc/file/` reference. Because exploitation requires privileged proxy access, this is treated as a defense-in-depth issue rather than a cross-tenant privilege bypass. ### Patches The issue is fixed in `1.83.10-stable`. LiteLLM recommend upgrading to `1.83.10-stable` or later. ### Workarounds Restrict `/health/test_connection` access to trusted administrators only.
- PYSEC-2026-3476LiteLLM: Local file read via request-supplied OIDC file references2026-07-23vendor · osvUS
### Impact LiteLLM's `/health/test_connection` endpoint resolved request-supplied environment and OIDC file references in `litellm_params`. A proxy administrator, or another privileged caller with permission to test model connections, could cause LiteLLM to read files from the local filesystem via an `oidc/file/` reference. Because exploitation requires privileged proxy access, this is treated as a defense-in-depth issue rather than a cross-tenant privilege bypass. ### Patches The issue is fixed in `1.83.10-stable`. LiteLLM recommend upgrading to `1.83.10-stable` or later. ### Workarounds Restrict `/health/test_connection` access to trusted administrators only.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://github.com/BerriAI/litellm/pull/25592cnnvd
- https://github.com/BerriAI/litellm/releasesPatchcnnvd
- https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stablecnnvd
- https://github.com/BerriAI/litellm/security/advisories/GHSA-4g5m-c9r5-49xfcnnvd
- https://github.com/BerriAI/litellm/pull/25592enisa_euvd
- https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stableenisa_euvd
- https://github.com/BerriAI/litellm/security/advisories/GHSA-4g5m-c9r5-49xfenisa_euvd
- https://github.com/BerriAI/litellm/pull/25592Issue TrackingPatchnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan