{"id":"GHSA-g5ff-637f-6q2m","title":"LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`","summary":"LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","vendor":"litellm","product":"litellm","ecosystem":"pip","affected":["litellm < 1.95.0"],"patched":["litellm 1.95.0"],"published":"2026-10-27","updated":"2026-10-27","sourceUpdated":"2026-10-27T15:47:24.299145356Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-g5ff-637f-6q2m","references":[{"url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-g5ff-637f-6q2m"},{"url":"https://github.com/BerriAI/litellm/pull/34189"},{"url":"https://github.com/BerriAI/litellm/commit/065faf6e695be64a1a367601271839914e4a6621"},{"url":"https://github.com/BerriAI/litellm"},{"url":"https://github.com/BerriAI/litellm/releases/tag/v1.95.0"},{"url":"https://github.com/advisories/GHSA-g5ff-637f-6q2m"}],"tags":["osv","pip","ghsa"],"cwe":["CWE-20","CWE-22"],"ingestedAt":"2026-10-27T16:11:58.714Z","slug":"GHSA-g5ff-637f-6q2m","body":"## Overview\n\n## Summary\n\nAn authenticated LiteLLM proxy user could read arbitrary local files from the proxy runtime by sending a crafted `vertex_ai_credentials` value to `/utils/transform_request`. The request-body safety blocklist rejected `vertex_credentials` but missed its alias `vertex_ai_credentials`, which let the value reach the Vertex AI credential loader and trigger a file read that is sent to an attacker-controlled URL.\n\n## Impact\n\nA low-privilege authenticated user (only `internal_user_viewer`, obtainable through SSO login on many deployments) could read any file readable by the LiteLLM process. Reading files such as `/proc/self/environ` can disclose `LITELLM_MASTER_KEY` and provider API keys, so the impact can escalate to full proxy-admin control.\n\n## Remediation\n\nUpgrade to `1.95.0` or later. The fix adds the missing alias to the request-body blocklist, so no configuration change is needed once you upgrade. There is no reliable configuration workaround on affected versions.\n\n## Affected packages\n\n- `litellm < 1.95.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `litellm 1.95.0`","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}