{"id":"GHSA-g5ff-637f-6q2m","kind":"vulnerability","aliases":["GHSA-g5ff-637f-6q2m"],"related":[],"title":"LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`","description":"## Summary\n\nAn authenticated LiteLLM proxy user could read arbitrary local files from the proxy runtime by sending a crafted `vertex_ai_credentials` value to `/utils/transform_request`. The request-body safety blocklist rejected `vertex_credentials` but missed its alias `vertex_ai_credentials`, which let the value reach the Vertex AI credential loader and trigger a file read that is sent to an attacker-controlled URL.\n\n## Impact\n\nA low-privilege authenticated user (only `internal_user_viewer`, obtainable through SSO login on many deployments) could read any file readable by the LiteLLM process. Reading files such as `/proc/self/environ` can disclose `LITELLM_MASTER_KEY` and provider API keys, so the impact can escalate to full proxy-admin control.\n\n## Remediation\n\nUpgrade to `1.95.0` or later. The fix adds the missing alias to the request-body blocklist, so no configuration change is needed once you upgrade. There is no reliable configuration workaround on affected versions.","summary":"An authenticated LiteLLM proxy user with only the internal_user_viewer role can send a crafted vertex_ai_credentials value to /utils/transform_request, which triggers a read of local files that are then sent to an attacker-controlled URL. Reading files such as /proc/self/environ can expose LITELLM_MASTER_KEY and provider API keys, which can escalate to full proxy-admin control.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"litellm","fixed":["1.95.0"],"affected":"< 1.95.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-gateway","ai-tooling","cwe-20","cwe-22","litellm","python","self-hosted"],"not_affected_if":["fixed-version","no-authenticated-users"],"how_to_check":"- Check the installed version with `pip show litellm` and confirm whether it is below `1.95.0`.\n- Confirm the proxy is reachable by users who hold the `internal_user_viewer` role, for example through SSO login.","fix":"- Upgrade LiteLLM to `1.95.0` or later; the fix adds the missing alias to the request-body blocklist and needs no configuration change.\n- Rotate `LITELLM_MASTER_KEY` and provider API keys if an affected version was reachable by low-privilege users, since they may have been read from the process environment.","status":"open","published_at":"2026-10-27T15:32:36+00:00","first_seen_at":"2026-10-27T15:34:04+00:00","triaged_at":"2026-10-27T15:35:38+00:00","updated_at":"2026-10-27T15:35:38+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-10-27T15:35:38Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade LiteLLM to `1.95.0` or later; the fix adds the missing alias to the request-body blocklist and needs no configuration change.\n- Rotate `LITELLM_MASTER_KEY` and provider API keys if an affected version was reachable by low-privilege users, since they may have been read from the process environment.","reach":"network","title":"LiteLLM: authenticated viewer can read arbitrary local files via alias","impact":"high","summary":"An authenticated LiteLLM proxy user with only the internal_user_viewer role can send a crafted vertex_ai_credentials value to /utils/transform_request, which triggers a read of local files that are then sent to an attacker-controlled URL. Reading files such as /proc/self/environ can expose LITELLM_MASTER_KEY and provider API keys, which can escalate to full proxy-admin control.","category":"ai-tooling","nicknames":[],"who_cares":["litellm","self-hosted","python","ai-gateway"],"confidence":0.85,"needs_auth":"yes","worst_case":"Low-privilege user reads process secrets, escalating to proxy admin.","analyst_note":"","how_to_check":"- Check the installed version with `pip show litellm` and confirm whether it is below `1.95.0`.\n- Confirm the proxy is reachable by users who hold the `internal_user_viewer` role, for example through SSO login.","needs_analyst":false,"not_affected_if":["fixed-version","no-authenticated-users"],"who_is_affected":"Teams running a LiteLLM proxy below 1.95.0 where users can authenticate, including via SSO, with the internal_user_viewer role. The exposure depends on the proxy process having readable secrets such as environment variables or credential files. Deployments on 1.95.0 or later, or with no authenticated users, are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000694,"input_tokens":3615,"output_tokens":665,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-20':31B '-22':33B '/proc/self/environ':82B,197C '/utils/transform_request':60B,125C '1.95.0':221C '637f':16A,21A '6q2m':17A,22A 'add':226C 'admin':99B,216C 'affect':252C 'ai':11A,25B,28B,56B,121C,140C,149C 'ai-gateway':24B 'ai-tool':27B 'alia':138C,229C 'api':90B,205C 'arbitrari':5A,109C 'attack':75B,163C 'attacker-control':74B,162C 'authent':40B,103C,171C 'blocklist':131C,235C 'bodi':129C,234C 'chang':239C 'configur':238C,249C 'control':76B,100B,164C,217C 'could':107C,184C 'craft':54B,119C 'credenti':12A,57B,122C,134C,141C,150C 'cwe':30B,32B 'deploy':183C 'disclos':199C 'escal':94B,211C 'expos':84B 'file':7A,67B,79B,111C,155C,187C,194C 'fix':225C 'full':96B,213C 'g5ff':15A,20A 'gateway':26B 'ghsa':14A,19A 'ghsa-g5ff-637f-6q2m':13A,18A 'host':38B 'impact':166C,209C 'intern':2A,47B,174C 'key':87B,91B,202C,206C 'later':223C 'let':143C 'litellm':1A,23A,34B,41B,85B,104C,191C,200C 'loader':151C 'local':6A,66B,110C 'login':180C 'low':169C 'low-privileg':168C 'mani':182C 'master':86B,201C 'miss':136C,228C 'need':241C 'obtain':177C 'privileg':170C 'process':192C 'provid':89B,204C 'proxi':42B,98B,105C,114C,215C 'proxy-admin':97B,214C 'python':35B 'reach':146C 'read':8A,64B,78B,108C,156C,185C,193C 'readabl':188C 'reject':132C 'reliabl':248C 'remedi':218C 'request':128C,233C 'request-bodi':127C,232C 'role':50B 'runtim':115C 'safeti':130C 'self':37B 'self-host':36B 'send':52B,117C 'sent':71B,159C 'sso':179C 'summari':101C 'tool':29B 'trigger':62B,153C 'upgrad':219C,244C 'url':77B,165C 'user':3A,43B,48B,106C,172C,175C 'valu':58B,123C,145C 'version':253C 'vertex':10A,55B,120C,133C,139C,148C 'via':9A 'viewer':4A,49B,176C 'workaround':250C","nicknames":[],"mitigations":[],"who_affected":"Teams running a LiteLLM proxy below 1.95.0 where users can authenticate, including via SSO, with the internal_user_viewer role. The exposure depends on the proxy process having readable secrets such as environment variables or credential files. Deployments on 1.95.0 or later, or with no authenticated users, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T15:32:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-g5ff-637f-6q2m","url":"https://github.com/advisories/GHSA-g5ff-637f-6q2m","severity":"high","published_at":"2026-10-27T15:32:36+00:00","modified_at":"2026-10-27T15:32:37+00:00","first_seen_at":"2026-10-27T15:34:04+00:00","fetched_at":"2026-10-27T15:34:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}