PYSEC-2026-3476
LiteLLM: Local file read via request-supplied OIDC file references
At a glance
- Published
- Updated
- CVE
- CVE-2026-59819
- Aliases
- GHSA-4g5m-c9r5-49xf
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Description
### Impact LiteLLM's `/health/test_connection` endpoint resolved request-supplied environment and OIDC file references in `litellm_params`. A proxy administrator, or another privileged caller with permission to test model connections, could cause LiteLLM to read files from the local filesystem via an `oidc/file/` reference. Because exploitation requires privileged proxy access, this is treated as a defense-in-depth issue rather than a cross-tenant privilege bypass. ### Patches The issue is fixed in `1.83.10-stable`. LiteLLM recommend upgrading to `1.83.10-stable` or later. ### Workarounds Restrict `/health/test_connection` access to trusted administrators only.
Affected packages
| Package | Versions |
|---|---|
| PyPI · litellm | introduced 0, fixed 1.83.10 |
References
- https://github.com/BerriAI/litellm/security/advisories/GHSA-4g5m-c9r5-49xf WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-59819 ADVISORY
- https://github.com/BerriAI/litellm/pull/25592 WEB
- https://github.com/BerriAI/litellm PACKAGE
- https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable WEB
- https://pypi.org/project/litellm PACKAGE
- https://github.com/advisories/GHSA-4g5m-c9r5-49xf ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |