{"id":"GHSA-w4c7-34wj-hqm8","kind":"vulnerability","aliases":["GHSA-w4c7-34wj-hqm8"],"related":[],"title":"Unauthenticated file read leaks master key on Enterprise proxy","description":"### Summary\r\n\r\nAn unauthenticated request to any LLM route on a LiteLLM proxy running with an Enterprise license could make the proxy read a local file and send its contents to a URL chosen by the attacker. Reading a file like `/proc/self/environ` exposes `LITELLM_MASTER_KEY` and provider API keys, which gives the attacker full admin access to the proxy. In some configurations, this allows the attacker to then execute arbitrary python code as root.\r\n\r\nOpen source deployments without a license are not affected, because the relevant codepaths only load when an Enterprise license is active. As defense in depth, we also recommend loading the master key from a secret manager instead of the process environment, setting a separate `LITELLM_SALT_KEY`, and limiting the proxy's outbound traffic to known provider endpoints.\r\n\r\n### Mitigations\r\nIf you cannot update immediately, consider implementing the following:\r\n* Block the trigger at the edge using a WAF, ingress filter, or reverse proxy rule: reject or strip POST request bodies that contain any of the JSON keys:\r\n  * `standard_callback_dynamic_params`\r\n  * `gcs_path_service_account`\r\n  * `callbacks`\r\n  * `success_callback`\r\n  * `failure_callback`\r\n* Restrict the proxy’s outbound network access to your configured LLM provider endpoints. The exploit requires the proxy to POST the stolen file contents to an attacker-controlled token endpoint; with egress allowlisted, the exfiltration fails even if the vulnerable code is reached.\r\n\r\nSeparately, we generally recommend keeping the proxy off the public internet where possible (e.g. via VPN, mTLS, an authenticating ingress, or an IP allowlist).\r\n\r\n\r\n### Credit\r\n\r\nOriginally discovered and reported by Dylan Ong at Karmasec - https://karmasec.io/\r\nIndependently discovered and reported by Cyrill Bannwart - Compass Security","summary":"A LiteLLM proxy running with an Enterprise license can be made to read a local file, such as /proc/self/environ, and send its contents to an attacker-chosen URL. The leaked file exposes LITELLM_MASTER_KEY and provider API keys, giving the attacker full admin access to the proxy, and in some configurations arbitrary Python code execution as root.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"litellm","fixed":["1.103.10"],"affected":"< 1.103.10","ecosystem":"pypi"},{"name":"litellm","fixed":["1.104.8"],"affected":"< 1.104.8","ecosystem":"pypi"},{"name":"litellm","fixed":["1.105.6"],"affected":"< 1.105.6","ecosystem":"pypi"},{"name":"litellm","fixed":["1.106.5"],"affected":"< 1.106.5","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-tooling","cwe-200","cwe-306","cwe-73","cwe-918","enterprise-license","litellm","python","self-hosted"],"not_affected_if":["managed-hosting","open-source-no-license"],"how_to_check":"- Check the installed version with `pip show litellm` and compare it with the fixed versions below.\n- Confirm whether the proxy runs with an Enterprise license; open source deployments without a license are not affected per the advisory.\n- Check whether the proxy is reachable from the public internet.","fix":"- `litellm` `1.103.10` on the 1.103 line\n- `litellm` `1.104.8` on the 1.104 line\n- `litellm` `1.105.6` on the 1.105 line\n- `litellm` `1.106.5` on the 1.106 line","status":"open","published_at":"2026-10-27T20:33:15+00:00","first_seen_at":"2026-11-09T22:53:22+00:00","triaged_at":"2026-11-09T22:54:05+00:00","updated_at":"2026-11-09T22:54:05+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-11-09T22:54:05Z","model":"claude-haiku-5-5","output":{"fix":"- `litellm` `1.103.10` on the 1.103 line\n- `litellm` `1.104.8` on the 1.104 line\n- `litellm` `1.105.6` on the 1.105 line\n- `litellm` `1.106.5` on the 1.106 line","reach":"internet","title":"LiteLLM proxy: unauthenticated file read leaks master key and provider keys","impact":"high","summary":"A LiteLLM proxy running with an Enterprise license can be made to read a local file, such as /proc/self/environ, and send its contents to an attacker-chosen URL. The leaked file exposes LITELLM_MASTER_KEY and provider API keys, giving the attacker full admin access to the proxy, and in some configurations arbitrary Python code execution as root.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["litellm","self-hosted","enterprise-license","python"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reads master key and provider keys, then may run code as root.","analyst_note":"","how_to_check":"- Check the installed version with `pip show litellm` and compare it with the fixed versions below.\n- Confirm whether the proxy runs with an Enterprise license; open source deployments without a license are not affected per the advisory.\n- Check whether the proxy is reachable from the public internet.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["open-source-no-license","managed-hosting"],"who_is_affected":"Only LiteLLM proxy deployments running with an Enterprise license are affected, since the vulnerable code paths load only when a license is active. The advisory says any LLM route on the proxy can trigger it without authentication, so an exposed proxy is the main concern. Teams that keep the proxy off the public internet and restrict its outbound traffic to provider endpoints reduce exposure, but the advisory still recommends updating.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000878,"input_tokens":5247,"output_tokens":706,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-200':28B '-306':30B '-73':32B '-918':34B '/proc/self/environ':61B,142C '34wj':13A,18A 'access':88B,157C,291C 'account':279C 'activ':196C 'admin':87B,156C 'affect':184C 'ai':25B 'ai-tool':24B 'allow':165C 'allowlist':318C,352C 'also':202C 'api':81B,149C 'arbitrari':96B,171C 'attack':69B,85B,137C,154C,167C,312C 'attacker-chosen':68B 'attacker-control':311C 'authent':347C 'bannwart':370C 'block':244C 'bodi':264C 'callback':273C,280C,282C,284C 'cannot':237C 'chosen':70B,134C 'code':98B,173C,326C 'codepath':188C 'compass':371C 'configur':95B,163C,294C 'consid':240C 'contain':266C 'content':65B,130C,308C 'control':313C 'could':119C 'credit':353C 'cwe':27B,29B,31B,33B 'cyril':369C 'defens':198C 'deploy':178C 'depth':200C 'discov':355C,365C 'dylan':359C 'dynam':274C 'e.g':342C 'edg':249C 'egress':317C 'endpoint':233C,297C,315C 'enterpris':8A,36B,49B,117C,193C 'enterprise-licens':35B 'environ':216C 'even':322C 'execut':99B,170C 'exfiltr':320C 'exploit':299C 'expos':75B,143C 'fail':321C 'failur':283C 'file':2A,58B,74B,126C,140C,307C 'filter':254C 'follow':243C 'full':86B,155C 'gcs':276C 'general':331C 'ghsa':11A,16A 'ghsa-w4c7-34wj-hqm8':10A,15A 'give':83B,152C 'host':42B 'hqm8':14A,19A 'immedi':239C 'implement':241C 'independ':364C 'ingress':253C,348C 'instead':212C 'internet':339C 'ip':351C 'json':270C 'karmasec':362C 'karmasec.io':363C 'keep':333C 'key':6A,78B,82B,146C,150C,207C,222C,271C 'known':231C 'leak':4A,73B 'licens':37B,50B,118C,181C,194C 'like':141C 'limit':224C 'litellm':20A,21A,22A,23A,38B,44B,76B,112C,144C,220C 'llm':108C,295C 'load':190C,204C 'local':57B,125C 'made':53B 'make':120C 'manag':211C 'master':5A,77B,145C,206C 'mitig':234C 'mtls':345C 'network':290C 'ong':360C 'open':176C 'origin':354C 'outbound':228C,289C 'param':275C 'path':277C 'possibl':341C 'post':262C,304C 'process':215C 'provid':80B,148C,232C,296C 'proxi':9A,45B,91B,113C,122C,160C,226C,257C,287C,302C,335C 'public':338C 'python':39B,97B,172C 'reach':328C 'read':3A,55B,123C,138C 'recommend':203C,332C 'reject':259C 'relev':187C 'report':357C,367C 'request':105C,263C 'requir':300C 'restrict':285C 'revers':256C 'root':101B,175C 'rout':109C 'rule':258C 'run':46B,114C 'salt':221C 'secret':210C 'secur':372C 'self':41B 'self-host':40B 'send':63B,128C 'separ':219C,329C 'servic':278C 'set':217C 'sourc':177C 'standard':272C 'stolen':306C 'strip':261C 'success':281C 'summari':102C 'token':314C 'tool':26B 'traffic':229C 'trigger':246C 'unauthent':1A,104C 'updat':238C 'url':71B,133C 'use':250C 'via':343C 'vpn':344C 'vulner':325C 'w4c7':12A,17A 'waf':252C 'without':179C","nicknames":[],"mitigations":[],"who_affected":"Only LiteLLM proxy deployments running with an Enterprise license are affected, since the vulnerable code paths load only when a license is active. The advisory says any LLM route on the proxy can trigger it without authentication, so an exposed proxy is the main concern. Teams that keep the proxy off the public internet and restrict its outbound traffic to provider endpoints reduce exposure, but the advisory still recommends updating.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["litellm"],"ptokens":["litellm"],"labels":["aitooling","critical","cwe200","cwe306","cwe73","cwe918","enterpriselicense","litellm","pypi","python","selfhosted"],"campaign_type":null,"search_a":"'34wj':13A,18A 'enterpris':8A 'file':2A 'ghsa':11A,16A 'ghsa-w4c7-34wj-hqm8':10A,15A 'hqm8':14A,19A 'key':6A 'leak':4A 'litellm':20A,21A,22A,23A 'master':5A 'proxi':9A 'read':3A 'unauthent':1A 'w4c7':12A,17A","search_b":"'-200':28B '-306':30B '-73':32B '-918':34B '/proc/self/environ':61B 'access':88B 'admin':87B 'ai':25B 'ai-tool':24B 'api':81B 'arbitrari':96B 'attack':69B,85B 'attacker-chosen':68B 'chosen':70B 'code':98B 'configur':95B 'content':65B 'cwe':27B,29B,31B,33B 'enterpris':36B,49B 'enterprise-licens':35B 'execut':99B 'expos':75B 'file':58B,74B 'full':86B 'give':83B 'host':42B 'key':78B,82B 'leak':73B 'licens':37B,50B 'litellm':38B,44B,76B 'local':57B 'made':53B 'master':77B 'provid':80B 'proxi':45B,91B 'python':39B,97B 'read':55B 'root':101B 'run':46B 'self':41B 'self-host':40B 'send':63B 'tool':26B 'url':71B","search_c":"'/proc/self/environ':142C 'access':157C,291C 'account':279C 'activ':196C 'admin':156C 'affect':184C 'allow':165C 'allowlist':318C,352C 'also':202C 'api':149C 'arbitrari':171C 'attack':137C,154C,167C,312C 'attacker-control':311C 'authent':347C 'bannwart':370C 'block':244C 'bodi':264C 'callback':273C,280C,282C,284C 'cannot':237C 'chosen':134C 'code':173C,326C 'codepath':188C 'compass':371C 'configur':163C,294C 'consid':240C 'contain':266C 'content':130C,308C 'control':313C 'could':119C 'credit':353C 'cyril':369C 'defens':198C 'deploy':178C 'depth':200C 'discov':355C,365C 'dylan':359C 'dynam':274C 'e.g':342C 'edg':249C 'egress':317C 'endpoint':233C,297C,315C 'enterpris':117C,193C 'environ':216C 'even':322C 'execut':170C 'exfiltr':320C 'exploit':299C 'expos':143C 'fail':321C 'failur':283C 'file':126C,140C,307C 'filter':254C 'follow':243C 'full':155C 'gcs':276C 'general':331C 'give':152C 'immedi':239C 'implement':241C 'independ':364C 'ingress':253C,348C 'instead':212C 'internet':339C 'ip':351C 'json':270C 'karmasec':362C 'karmasec.io':363C 'keep':333C 'key':146C,150C,207C,222C,271C 'known':231C 'licens':118C,181C,194C 'like':141C 'limit':224C 'litellm':112C,144C,220C 'llm':108C,295C 'load':190C,204C 'local':125C 'make':120C 'manag':211C 'master':145C,206C 'mitig':234C 'mtls':345C 'network':290C 'ong':360C 'open':176C 'origin':354C 'outbound':228C,289C 'param':275C 'path':277C 'possibl':341C 'post':262C,304C 'process':215C 'provid':148C,232C,296C 'proxi':113C,122C,160C,226C,257C,287C,302C,335C 'public':338C 'python':172C 'reach':328C 'read':123C,138C 'recommend':203C,332C 'reject':259C 'relev':187C 'report':357C,367C 'request':105C,263C 'requir':300C 'restrict':285C 'revers':256C 'root':175C 'rout':109C 'rule':258C 'run':114C 'salt':221C 'secret':210C 'secur':372C 'send':128C 'separ':219C,329C 'servic':278C 'set':217C 'sourc':177C 'standard':272C 'stolen':306C 'strip':261C 'success':281C 'summari':102C 'token':314C 'traffic':229C 'trigger':246C 'unauthent':104C 'updat':238C 'url':133C 'use':250C 'via':343C 'vpn':344C 'vulner':325C 'waf':252C 'without':179C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T20:33:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-w4c7-34wj-hqm8","url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-w4c7-34wj-hqm8","severity":"critical","published_at":"2026-10-27T20:33:15+00:00","modified_at":"2026-10-27T21:45:01+00:00","first_seen_at":"2026-11-09T22:53:22+00:00","fetched_at":"2026-11-09T22:53:22+00:00","note":null}],"documents":[{"id":110572,"url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-w4c7-34wj-hqm8","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}