Skip to content
Threat Feed
Subscribe
high advisory

LiteLLM: Local file read vulnerability in vertex_ai_credentials

An authenticated user with the internal_user_viewer role can read arbitrary local files from the LiteLLM proxy runtime by exploiting an incomplete blocklist in the vertex_ai_credentials parameter.

CVE search metadata

CVE search record: CVE-2026-114612. Severity: critical. CVSS: 9.9. EPSS: 0.32%. KEV: no. Product: LiteLLM (< 1.95.0), LiteLLM (>= 1.91.0, < 1.100.4), LiteLLM (>= 1.101.0, < 1.101.3), LiteLLM (>= 1.102.0, < 1.102.2), LiteLLM (>= 1.103.0, < 1.103.1), LiteLLM (>= 1.104.0rc1, < 1.104.0rc2). Brief: LiteLLM: Local file read vulnerability in vertex_ai_credentials. Brief link: https://feed.craftedsignal.io/briefs/2026-10-litellm-file-read/

Triage facts

Revision 2
Applicability
LiteLLM (< 1.95.0), LiteLLM (>= 1.91.0, < 1.100.4) +4
Evidence
Unknown
Severity
High
Action
Elevated
Sources
3 public sources
Freshness
Revision 2Oct 29, 19:55 UTC
Vulnerabilities
1 CVE
Source quality
A1Likely
Revision history 1 entry · Revision 2
  1. Revision 2

    added coverage for LiteLLM (>= 1.91.0, < 1.100.4) +4 products

    Changed: action_plan, affected_products, cpes, cves, lastmod, priority, priority_score, priority_signals, references, ttps, updates

    Sources: 1

LiteLLM contains a vulnerability where the /utils/transform_request endpoint fails to properly sanitize the vertex_ai_credentials parameter. While vertex_credentials was explicitly blocked in the request-body safety checks, the alias vertex_ai_credentials was omitted. An authenticated user with the internal_user_viewer role can supply a local file path to this parameter, causing the application to read the file and potentially transmit its contents to an attacker-controlled destination.

Impact

An attacker can read any file accessible by the system user running the LiteLLM process. Sensitive files such as /proc/self/environ may contain environment variables, including LITELLM_MASTER_KEY and various provider API keys, leading to full administrative compromise of the proxy instance.

Recommendation

Upgrade the LiteLLM package to version 1.95.0 or later immediately. The updated version includes vertex_ai_credentials in the request-body blocklist, mitigating the vulnerability. No configuration workarounds are available for versions prior to 1.95.0.

Immediate actions

Upgrade LiteLLM to 1.95.0 or later

IT Operations 48h

Patch LiteLLM to 1.100.4, 1.101.3, 1.102.2, 1.103.1, or 1.104.0rc2

IT Operations 24h

Set EXPERIMENTAL_UI_LOGIN=false if immediate upgrade is not possible

IT Operations 24h

Threat Hunt

Identify requests to /utils/transform_request containing vertex_ai_credentials in the request body

T1083 high high confidence hunt now

Data: Web server access logs or application-level request logs

Identify unusual API key creation requests containing metadata fields associated with administrative credential patterns

T1068 high medium confidence hunt now

Data: LiteLLM application logs (API request payloads), Authentication service logs

Mitigations

Upgrade LiteLLM to 1.95.0

immediate IT Operations

LiteLLM Local File Read

Upgrade to non-vulnerable versions or disable EXPERIMENTAL_UI_LOGIN

immediate IT Operations

CVE-2026-114612