---
id: GHSA-g5ff-637f-6q2m
title: >-
  LiteLLM: internal_user_viewer arbitrary local file read via
  `vertex_ai_credentials`
summary: >-
  LiteLLM: internal_user_viewer arbitrary local file read via
  `vertex_ai_credentials`
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
vendor: litellm
product: litellm
ecosystem: pip
affected:
  - litellm < 1.95.0
patched:
  - litellm 1.95.0
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T15:47:24.299145356Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-g5ff-637f-6q2m'
references:
  - url: 'https://github.com/BerriAI/litellm/security/advisories/GHSA-g5ff-637f-6q2m'
  - url: 'https://github.com/BerriAI/litellm/pull/34189'
  - url: >-
      https://github.com/BerriAI/litellm/commit/065faf6e695be64a1a367601271839914e4a6621
  - url: 'https://github.com/BerriAI/litellm'
  - url: 'https://github.com/BerriAI/litellm/releases/tag/v1.95.0'
  - url: 'https://github.com/advisories/GHSA-g5ff-637f-6q2m'
tags:
  - osv
  - pip
  - ghsa
cwe:
  - CWE-20
  - CWE-22
ingestedAt: '2026-10-27T16:11:58.714Z'
---

## Overview

## Summary

An authenticated LiteLLM proxy user could read arbitrary local files from the proxy runtime by sending a crafted `vertex_ai_credentials` value to `/utils/transform_request`. The request-body safety blocklist rejected `vertex_credentials` but missed its alias `vertex_ai_credentials`, which let the value reach the Vertex AI credential loader and trigger a file read that is sent to an attacker-controlled URL.

## Impact

A low-privilege authenticated user (only `internal_user_viewer`, obtainable through SSO login on many deployments) could read any file readable by the LiteLLM process. Reading files such as `/proc/self/environ` can disclose `LITELLM_MASTER_KEY` and provider API keys, so the impact can escalate to full proxy-admin control.

## Remediation

Upgrade to `1.95.0` or later. The fix adds the missing alias to the request-body blocklist, so no configuration change is needed once you upgrade. There is no reliable configuration workaround on affected versions.

## Affected packages

- `litellm < 1.95.0`

## Remediation

Upgrade to a patched release:

- `litellm 1.95.0`