Executive brief
LiteLLM is a proxy server used to connect various AI models to applications. A security flaw in its connection testing tool allows an administrator to read sensitive files from the server's local storage. While this requires administrative access, it could allow a malicious insider or a compromised admin account to access configuration data or other system files.
Technical details
A local file inclusion (LFI) vulnerability exists in LiteLLM's `/health/test_connection` endpoint due to improper validation of the `litellm_params` parameter. The endpoint resolves request-supplied OIDC file references (using the `oidc/file/` prefix), allowing an attacker to specify arbitrary local file paths. Exploitation requires high privileges (proxy administrator) and network access to the management endpoint. Successful exploitation allows the reading of local files, potentially exposing sensitive environment variables or system secrets. The issue is addressed in version 1.83.10-stable by improving how file references are resolved.
Affected products
- BerriAI LiteLLM < 1.83.10-stable
Timeline
- 2026-06-30: disclosed: Initial report to vendor
- 2026-07-08: advisory: NVD publication
- 2026-07-22: patched: GitHub Advisory published and fix confirmed in 1.83.10-stable