Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-08T19:33:32 litellm: LiteLLM: Information disclosure via local file read in test connection endpoint 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N CWE-22

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.10-stable, LiteLLM's /health/test_connection endpoint resolved request-supplied environment and OIDC file references in litellm_params, allowing a proxy administrator or another privileged caller with permission to test model connections to read files from the local filesystem via an oidc/file/ reference. This issue is fixed in version 1.83.10-stable.

A flaw was found in LiteLLM, a proxy server for Large Language Model (LLM) APIs. A privileged caller, such as a proxy administrator, with permissions to test model connections, could exploit the /health/test_connection endpoint. By supplying specific environment or OIDC (OpenID Connect) file references, an attacker could read arbitrary files from the local filesystem. This unauthorized file access could lead to information disclosure.

LiteLLM Proxy Server exposes a POST /health/test_connection endpoint that resolves os.environ/ references supplied in request parameters and reads OIDC credential files via the oidc/file/ secret provider without restricting the file path to an approved credentials directory. A caller with access to this endpoint could read local environment variable values or arbitrary files reachable via a crafted OIDC file reference, resulting in information disclosure. This is fixed upstream in litellm 1.83.14, which rejects os.environ/ references in request parameters and enforces an allow-listed OIDC credential directory. Red Hat components that use the litellm Python package only as an LLM client library (litellm.completion()/litellm.acompletion() and similar), without running the LiteLLM Proxy Server, do not expose this endpoint and are not affected. Upgrade to litellm >= 1.83.14. If upgrading is not immediately possible, restrict network access to the LiteLLM Proxy Server administrative API (including /health/test_connection) to trusted, authenticated proxy/team administrators only, and avoid setting LITELLM_OIDC_ALLOWED_CREDENTIAL_DIRS or OIDC file secret providers to sensitive filesystem paths. Exploit Intelligence Not affected exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Lightspeed Core Not affected lightspeed-core/lightspeed-stack-rhel9 Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-26/lightspeed-chatbot-rhel9 Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-27/lightspeed-chatbot-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-llama-stack-core-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-59819 https://nvd.nist.gov/vuln/detail/CVE-2026-59819 https://github.com/BerriAI/litellm/pull/25592 https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable https://github.com/BerriAI/litellm/security/advisories/GHSA-4g5m-c9r5-49xf