GHSA-g5ff-637f-6q2m

LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`

Published

2026-10-27

Modified

2026-10-27

Sources

github-advisory

Summary

## Summary An authenticated LiteLLM proxy user could read arbitrary local files from the proxy runtime by sending a crafted `vertex_ai_credentials` value to `/utils/transform_request`. The request-body safety blocklist rejected `vertex_credentials` but missed its alias `vertex_ai_credentials`, which let the value reach the Vertex AI credential loader and trigger a file read that is sent to an attacker-controlled URL. ## Impact A low-privilege authenticated user (only `internal_user_viewer`, obtainable through SSO login on many deployments) could read any file readable by the LiteLLM process. Reading files such as `/proc/self/environ` can disclose `LITELLM_MASTER_KEY` and provider API keys, so the impact can escalate to full proxy-admin control. ## Remediation Upgrade to `1.95.0` or later. The fix adds the missing alias to the request-body blocklist, so no configuration change is needed once you upgrade. There is no reliable configuration workaround on affected versions.

Affected packages

Remediation: Upgrade to 1.95.0 or later.

References

• https://github.com/advisories/GHSA-g5ff-637f-6q2m