LiteLLM (>= 1.103.0, < 1.103.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/litellm--1.103.0--1.103.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 19:49:34 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLiteLLM: Local file read vulnerability in vertex_ai_credentialshttps://feed.craftedsignal.io/briefs/2026-10-litellm-file-read/Thu, 29 Oct 2026 19:49:34 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-litellm-file-read/An authenticated user with the internal_user_viewer role can read arbitrary local files from the LiteLLM proxy runtime by exploiting an incomplete blocklist in the vertex_ai_credentials parameter.LiteLLM contains a vulnerability where the /utils/transform_request endpoint fails to properly sanitize the vertex_ai_credentials parameter. While vertex_credentials was explicitly blocked in the request-body safety checks, the alias vertex_ai_credentials was omitted. An authenticated user with the internal_user_viewer role can supply a local file path to this parameter, causing the application to read the file and potentially transmit its contents to an attacker-controlled destination.

Impact

An attacker can read any file accessible by the system user running the LiteLLM process. Sensitive files such as /proc/self/environ may contain environment variables, including LITELLM_MASTER_KEY and various provider API keys, leading to full administrative compromise of the proxy instance.

Recommendation

Upgrade the LiteLLM package to version 1.95.0 or later immediately. The updated version includes vertex_ai_credentials in the request-body blocklist, mitigating the vulnerability. No configuration workarounds are available for versions prior to 1.95.0.

]]>highadvisory