Zero Radar
← feed
HighVulnerabilityGHSA-g5ff-637f-6q2mupdated 27 Oct 2026, 15:33 UTC

LiteLLM proxy lets logged-in users read server files

A low-privilege logged-in user could trick the LiteLLM proxy into reading files on its server, such as secret keys. Those secrets could then give them full control of the proxy.

Fix availableOfficial source
SeverityHighCVSS 8.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yes1.95.0 and later. The fix adds the missing alias to the blocklist; no configuration change is needed after upgrading. · since 27 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Low-privilege userAuthenticated via SSO with viewer role
  2. 2Crafted requestSends vertex_ai_credentials to transform_request
  3. 3Filter bypassedAlias missed by request blocklist
  4. 4File readCredential loader reads local file, e.g. environ
  5. 5Data exfiltratedContents sent to attacker-controlled URL
  6. ResultSecrets exposed, possible proxy-admin takeover

What happened

The LiteLLM proxy's request filter blocked the field name 'vertex_credentials' but missed its alias 'vertex_ai_credentials' on the /utils/transform_request endpoint. The alias reached the Vertex AI credential loader, which reads a local file and sends its contents to an attacker-controlled URL.

Why it is dangerous: Any file the LiteLLM process can read may be exposed, including /proc/self/environ, which can reveal LITELLM_MASTER_KEY and provider API keys. This can escalate to full proxy-admin access. Users with only the low-privilege internal_user_viewer role, often obtained through SSO login, can exploit it.

Are you affected?

You are affected if you run LiteLLM proxy below version 1.95.0 and allow authenticated users, including SSO users with the internal_user_viewer role.

Package / productAffected versionsFixed in
litellm · pip< 1.95.01.95.0

What to do

  1. Upgrade litellm to 1.95.0 or later (pip install --upgrade 'litellm>=1.95.0')
  2. Rotate LITELLM_MASTER_KEY and provider API keys if affected versions were exposed to untrusted users
  3. Review who holds the internal_user_viewer role and limit SSO access where possible

Timeline

  1. 27 Oct 2026, 15:32 UTC
    Publicly disclosed
  2. 27 Oct 2026, 15:32 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 27 Oct 2026, 15:33 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
GHSA-g5ff-637f-6q2m
CVSS
8.1 / 10
Disclosed
27 Oct 2026, 15:32 UTC
On Zero Radar
27 Oct 2026, 15:33 UTC (1 min after disclosure)
Last change
27 Oct 2026, 15:33 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

LiteLLM proxy lets logged-in users read server files · Zero Radar