{"schema":"threatline.record/2","record":{"id":"GHSA-g5ff-637f-6q2m","aliases":["GHSA-g5ff-637f-6q2m"],"summary":"internal_user_viewer arbitrary local file read via `vertex_ai_credentials`","details":"## Summary\r\n\r\nAn authenticated LiteLLM proxy user could read arbitrary local files from the proxy runtime by sending a crafted `vertex_ai_credentials` value to `/utils/transform_request`. The request-body safety blocklist rejected `vertex_credentials` but missed its alias `vertex_ai_credentials`, which let the value reach the Vertex AI credential loader and trigger a file read that is sent to an attacker-controlled URL.\r\n\r\n## Impact\r\n\r\nA low-privilege authenticated user (only `internal_user_viewer`, obtainable through SSO login on many deployments) could read any file readable by the LiteLLM process. Reading files such as `/proc/self/environ` can disclose `LITELLM_MASTER_KEY` and provider API keys, so the impact can escalate to full proxy-admin control.\r\n\r\n## Remediation\r\n\r\nUpgrade to `1.95.0` or later. The fix adds the missing alias to the request-body blocklist, so no configuration change is needed once you upgrade. There is no reliable configuration workaround on affected versions.","categories":["Unclassified"],"product":"litellm","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-g5ff-637f-6q2m","source_modified_at":"2026-10-01T13:57:14Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"litellm"},"range":"<1.95.0"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-g5ff-637f-6q2m","source_modified_at":"2026-10-01T13:57:14Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"litellm"},"version":"1.95.0"}],"cvss":8.1,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-01T13:57:14Z","modified_at":"2026-10-01T13:57:14Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-g5ff-637f-6q2m","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-01T13:57:14Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-01T13:57:14Z","content_hash":"5129e23f1ff741f386995657d8ee972528a5eee3d35018ef344cb67b018e5580"}}