Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

High severity, with a CVSS score of 8.1, published 27 October 2026.

Which products and versions are affected?

Berriai LiteLLM < 1.95.0; litellm (PyPI) < 1.95.0, ECOSYSTEM:introduced=0,fixed=1.95.0.

Is there a fix for This vulnerability?

Yes. litellm (PyPI): upgrade to 1.95.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run Berriai LiteLLM or litellm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

LiteLLM arbitrary local file read via vertex_ai_credentials

Q: Which products and versions are affected?

Berriai LiteLLM < 1.95.0; litellm (PyPI) < 1.95.0, ECOSYSTEM:introduced=0,fixed=1.95.0.

Q: Is there a fix for This vulnerability?

Yes. litellm (PyPI): upgrade to 1.95.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run Berriai LiteLLM or litellm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: high · CVSS 8.1 · Published 2026-10-27

LiteLLM is an open-source proxy for AI model APIs. An authenticated low-privilege user can exploit an incomplete request validation to read arbitrary files from the server, including sensitive environment variables containing API keys and master credentials. This allows attackers with basic SSO access to escalate privileges to full administrative control over the proxy.

Technologies: Berriai LiteLLM, litellm (PyPI). Vendors: Berriai, PyPI.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: High severity, with a CVSS score of 8.1, published 27 October 2026.
Which products and versions are affected?: Berriai LiteLLM < 1.95.0; litellm (PyPI) < 1.95.0, ECOSYSTEM:introduced=0,fixed=1.95.0.
Is there a fix for This vulnerability?: Yes. litellm (PyPI): upgrade to 1.95.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run Berriai LiteLLM or litellm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

litellm (PyPI): upgrade to 1.95.0 or later
```
pip install "litellm>=1.95.0"
```

Technical details

The vulnerability is an input validation bypass in LiteLLM's `/utils/transform_request` endpoint. The request-body blocklist rejected `vertex_credentials` but missed its alias `vertex_ai_credentials`, allowing the malicious parameter to reach the Vertex AI credential loader which performs an arbitrary local file read sent to an attacker-controlled URL. Exploitation requires network access and prior authentication as an `internal_user_viewer` role (obtainable through SSO on many deployments).

Affected products

BerriAI LiteLLM < 1.95.0

Timeline

2026-10-01: disclosed
2026-10-27: advisory

References

https://api.github.com/users/rekter0

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.