Security brief

LiteLLM file-read flaw could expose proxy secrets to low-privilege users

REVIEW

An authenticated low-privilege user could access proxy-readable files. The advisory identifies 1.95.0 as the fixed release.

Published 29 Oct 2026 · Material update 27 Oct 2026 — last time the underlying evidence changed · Evidence: high

What happened

A low-privilege account can still be dangerous when a proxy processes credentials on its behalf. A reviewed LiteLLM advisory describes a local-file read reachable by authenticated users, including the internal_user_viewer role.

A request-body filter blocked one credential parameter but missed an alias. That gap allowed a credential-loading path to read files accessible to the LiteLLM process and send their contents to an attacker-controlled destination.

Exposed environment data could include provider keys and the proxy master key, potentially enabling administrative access.

Remediation

The advisory lists versions below 1.95.0 as affected and 1.95.0 as patched. It reports no reliable configuration workaround for affected versions.

When assessing exposure, check the deployed version and whether untrusted users could authenticate. A read-only role should not be assumed to protect host secrets from this flaw.

Read advisory GHSA-g5ff-637f-6q2m.

Who should check?

Operators of authenticated LiteLLM proxies below version 1.95.0.

Next step

Upgrade to 1.95.0 or a later supported release.

What we know

Affected package
litellm
Fixed version
1.95.0

What remains unknown

Open question
This advisory review does not establish exploitation of your deployment.

Source references