LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`

Overview

Summary

An authenticated LiteLLM proxy user could read arbitrary local files from the proxy runtime by sending a crafted vertex_ai_credentials value to /utils/transform_request. The request-body safety blocklist rejected vertex_credentials but missed its alias vertex_ai_credentials, which let the value reach the Vertex AI credential loader and trigger a file read that is sent to an attacker-controlled URL.

Impact

A low-privilege authenticated user (only internal_user_viewer, obtainable through SSO login on many deployments) could read any file readable by the LiteLLM process. Reading files such as /proc/self/environ can disclose LITELLM_MASTER_KEY and provider API keys, so the impact can escalate to full proxy-admin control.

Remediation

Upgrade to 1.95.0 or later. The fix adds the missing alias to the request-body blocklist, so no configuration change is needed once you upgrade. There is no reliable configuration workaround on affected versions.

Affected packages

• litellm < 1.95.0

Remediation

Upgrade to a patched release:

• litellm 1.95.0