Live › vulnerability › GHSA-g5ff-637f-6q2m
Go to dashboardAn authenticated LiteLLM proxy user with only the internal_user_viewer role can send a crafted vertex_ai_credentials value to /utils/transform_request, which triggers a read of local files that are then sent to an attacker-controlled URL. Reading files such as /proc/self/environ can expose LITELLM_MASTER_KEY and provider API keys, which can escalate to full proxy-admin control.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 15:34 UTC. All times on this page are UTC.
Teams running a LiteLLM proxy below 1.95.0 where users can authenticate, including via SSO, with the internal_user_viewer role. The exposure depends on the proxy process having readable secrets such as environment variables or credential files. Deployments on 1.95.0 or later, or with no authenticated users, are not affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| litellm | pypi | < 1.95.0 | 1.95.0 |
pip show litellm and confirm whether it is below 1.95.0.internal_user_viewer role, for example through SSO login.1.95.0 or later; the fix adds the missing alias to the request-body blocklist and needs no configuration change.LITELLM_MASTER_KEY and provider API keys if an affected version was reachable by low-privilege users, since they may have been read from the process environment.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An authenticated LiteLLM proxy user could read arbitrary local files from the proxy runtime by sending a crafted vertex_ai_credentials value to /utils/transform_request. The request-body safety blocklist rejected vertex_credentials but missed its alias vertex_ai_credentials, which let the value reach the Vertex AI credential loader and trigger a file read that is sent to an attacker-controlled URL.
A low-privilege authenticated user (only internal_user_viewer, obtainable through SSO login on many deployments) could read any file readable by the LiteLLM process. Reading files such as /proc/self/environ can disclose LITELLM_MASTER_KEY and provider API keys, so the impact can escalate to full proxy-admin control.
Upgrade to 1.95.0 or later. The fix adds the missing alias to the request-body blocklist, so no configuration change is needed once you upgrade. There is no reliable configuration workaround on affected versions.
This page as .md · .json · in your agent: get_signal("GHSA-g5ff-637f-6q2m")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.