AIKIDO-2026-715385

litellm is vulnerable to Arbitrary File Read

Arbitrary File ReadGHSA-g5ff-637f-6q2m Published 6 days ago

High Risk

This Affects:

litellm

0.0.1 - 1.88.5

Fixed in 1.88.6

1.89.0 - 1.89.6

Fixed in 1.89.7

1.90.0 - 1.90.6

Fixed in 1.90.7

1.91.0 - 1.91.4

Fixed in 1.91.5

1.92.0 - 1.92.1

Fixed in 1.92.2

1.93.0 - 1.93.1

Fixed in 1.93.2

1.94.0 - 1.94.2

Fixed in 1.94.3

Are you affected? Scan for Free

TL;DR

The request body blocklist for /utils/transform_request rejects the vertex_credentials key but not its alias vertex_ai_credentials, so a crafted value under that alias reaches the Vertex AI credential loader unfiltered. An authenticated low privilege internal_user_viewer can pass a local file path through this alias and make the credential loader read the file and send its contents to a URL the attacker chooses. Reading files such as /proc/self/environ discloses the LITELLM_MASTER_KEY and provider API keys, escalating the read into full proxy admin control. The fix adds the missing alias to the blocklist.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you expose /utils/transform_request to users holding the internal_user_viewer role or lower privilege.

Background info

litellm is vulnerable to Arbitrary File Read in versions 0.0.1 - 1.88.5, 1.89.0 - 1.89.6, 1.90.0 - 1.90.6, 1.91.0 - 1.91.4, 1.92.0 - 1.92.1, 1.93.0 - 1.93.1 and 1.94.0 - 1.94.2.