LiteLLMGHSA-4g5m-c9r5-49xf
LiteLLM: Local file read via request-supplied OIDC file references
LowCVE-2026-59819 · Published Jul 22, 2026 · updated Sep 10, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| litellm PyPI | < 1.83.10 | 1.83.10 |
Details and references
### Impact LiteLLM's `/health/test_connection` endpoint resolved request-supplied environment and OIDC file references in `litellm_params`. A proxy administrator, or another privileged caller with permission to test model connections, could cause LiteLLM to read files from the local filesystem via an `oidc/file/` reference. Because exploitation requires privileged proxy access, this is treated as a defense-in-depth issue rather than a cross-tenant privilege bypass. ### Patches The issue is fixed in `1.83.10-stable`. LiteLLM recommend upgrading to `1.83.10-stable` or later. ### Workarounds Restrict `/health/test_connection` access to trusted administrators only.
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-73
- Also known as
- CVE-2026-59819, PYSEC-2026-3476
More LiteLLM advisories
All LiteLLM| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 22 | LiteLLM: Arbitrary file write via path traversal in Skills archive extraction CVE-2026-59820Mediumfixed in 1.83.7 | Medium | 1.83.7 |
| Jul 22 | LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback CVE-2026-59822Highfixed in 1.84.0 | High | 1.84.0 |
| Jul 22 | LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks CVE-2026-59821Lowfixed in 1.82.0 | Low | 1.82.0 |
| Jun 21 | BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader CVE-2026-12798Low6.3no fix yet | Low6.3 | No fix yet |
| Jun 21 | BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure CVE-2026-12799Low4.3no fix yet | Low4.3 | No fix yet |
| Jun 21 | BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints CVE-2026-12797Low6.3no fix yet | Low6.3 | No fix yet |