CVE-2026-59819: LiteLLM Information Disclosure Vulnerability

CVE-2026-59819 Overview

CVE-2026-59819 affects LiteLLM, a proxy server (AI Gateway) that routes calls to large language model (LLM) APIs using OpenAI-compatible or native formats. The vulnerability resides in the /health/test_connection endpoint, which resolves request-supplied environment and OpenID Connect (OIDC) file references inside litellm_params. A privileged caller authorized to test model connections can supply an oidc/file/ reference to read arbitrary files from the local filesystem of the proxy host. The issue is classified as external control of file name or path [CWE-73] and is fixed in version 1.83.10-stable.

Critical Impact
An authenticated proxy administrator can read arbitrary local files from the LiteLLM host, including secrets, tokens, and configuration data referenced by the process.

Affected Products

LiteLLM (BerriAI) proxy server versions prior to 1.83.10-stable
Deployments exposing the /health/test_connection endpoint to privileged callers
Self-hosted AI Gateway installations of LiteLLM

Discovery Timeline

2026-07-08 - CVE-2026-59819 published to the National Vulnerability Database (NVD)
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-59819

Vulnerability Analysis

LiteLLM exposes /health/test_connection so administrators can validate configured model backends. The endpoint accepts litellm_params from the request body and passes them through the same parameter resolution logic used at runtime. That resolver interprets values prefixed with oidc/file/ as filesystem paths to load OIDC token material. Because the endpoint does not restrict which references it will resolve on behalf of the caller, an attacker with permission to invoke the endpoint can substitute the OIDC file reference with any path the LiteLLM process can read.

The outcome is arbitrary file disclosure limited only by the filesystem permissions of the LiteLLM process. Sensitive targets include API keys stored on disk, .env files, mounted Kubernetes secrets, cloud metadata cache files, and OIDC private keys. Exploitation requires high privileges (PR:H), which restricts the scope to callers already trusted to configure or test models, but the ability to exfiltrate host secrets can be used to escalate access to backing LLM providers or infrastructure accounts.

Root Cause

The root cause is external control of file name or path [CWE-73]. The test_connection handler reuses the full litellm_params resolution path, which trusts oidc/file/ references as internal configuration rather than untrusted input. No allowlist, path canonicalization, or context check prevents caller-supplied paths from being dereferenced.

Attack Vector

An authenticated administrator sends a crafted POST request to /health/test_connection with litellm_params containing an oidc/file/<absolute_path> value in a field that undergoes reference resolution. The server opens the referenced file to build the OIDC assertion and surfaces the contents through the connection-test flow. The attack is network-reachable and requires no user interaction, but does require an authenticated privileged token.

No verified exploit code is published. Refer to the GitHub Security Advisory GHSA-4g5m-c9r5-49xf and the remediation pull request for the technical fix.

Detection Methods for CVE-2026-59819

Indicators of Compromise

Requests to /health/test_connection containing oidc/file/ substrings in the JSON body or litellm_params fields.
Access log entries showing repeated test_connection calls from a single administrator token targeting varied model configurations.
LiteLLM process file reads to paths outside the expected model configuration directory, such as /etc/, /proc/, or user home directories.

Detection Strategies

Enable request-body logging on the LiteLLM proxy and alert on oidc/file/ values submitted to /health/test_connection.
Correlate administrator API-key usage with unusual patterns of connection tests against many distinct model configurations.
Deploy filesystem auditing (auditd on Linux) on the LiteLLM host to flag reads of secret directories by the LiteLLM service account.

Monitoring Recommendations

Forward LiteLLM proxy access logs and host audit logs to a centralized SIEM for correlation.
Baseline normal /health/test_connection volume per administrator and alert on deviations.
Track LiteLLM version inventory to confirm all instances are running 1.83.10-stable or later.

How to Mitigate CVE-2026-59819

Immediate Actions Required

Upgrade LiteLLM to version 1.83.10-stable or later on all proxy hosts.
Rotate any credentials, API keys, and OIDC signing material that were reachable from the LiteLLM process filesystem.
Restrict issuance of administrator-level LiteLLM API keys and audit existing keys that hold connection-test permissions.

Patch Information

The fix is included in LiteLLM release v1.83.10-stable and implemented in pull request #25592. The patch removes resolution of caller-supplied oidc/file/ references within the /health/test_connection code path. Coordinated details are published in GHSA-4g5m-c9r5-49xf.

Workarounds

Block or authenticate /health/test_connection at an upstream reverse proxy until upgrade is complete.
Run the LiteLLM process as an unprivileged user with a minimal filesystem view, using containers or mount namespaces to remove access to host secrets.
Remove OIDC file-based credential providers from configuration and use environment injection through a secrets manager instead.

bash

# Configuration example: pin LiteLLM to the patched release
pip install --upgrade 'litellm==1.83.10'

# Verify installed version
litellm --version

# Optional: restrict the health endpoint at the reverse proxy (nginx example)
# location /health/test_connection {
#     allow 10.0.0.0/24;   # management network only
#     deny all;
#     proxy_pass http://litellm_upstream;
# }