CVE-2026-59819

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59819", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-07T15:00:50.978Z", "datePublished": "2026-07-08T19:33:32.816Z", "dateUpdated": "2026-07-09T14:30:14.779Z"}, "containers": {"cna": {"title": "LiteLLM: Local file read via request-supplied OIDC file references", "problemTypes": [{"descriptions": [{"cweId": "CWE-73", "lang": "en", "description": "CWE-73: External Control of File Name or Path", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2.1, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/BerriAI/litellm/security/advisories/GHSA-4g5m-c9r5-49xf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/BerriAI/litellm/security/advisories/GHSA-4g5m-c9r5-49xf"}, {"name": "https://github.com/BerriAI/litellm/pull/25592", "tags": ["x_refsource_MISC"], "url": "https://github.com/BerriAI/litellm/pull/25592"}, {"name": "https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable", "tags": ["x_refsource_MISC"], "url": "https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable"}], "affected": [{"vendor": "BerriAI", "product": "litellm", "versions": [{"version": "< 1.83.10-stable", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-08T19:33:32.816Z"}, "descriptions": [{"lang": "en", "value": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.10-stable, LiteLLM's /health/test_connection endpoint resolved request-supplied environment and OIDC file references in litellm_params, allowing a proxy administrator or another privileged caller with permission to test model connections to read files from the local filesystem via an oidc/file/ reference. This issue is fixed in version 1.83.10-stable."}], "source": {"advisory": "GHSA-4g5m-c9r5-49xf", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-09T14:30:04.946174Z", "id": "CVE-2026-59819", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T14:30:14.779Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-59819", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T14:30:04.946174Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T14:30:09.532Z"}}], "cna": {"title": "LiteLLM: Local file read via request-supplied OIDC file references", "source": {"advisory": "GHSA-4g5m-c9r5-49xf", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "BerriAI", "product": "litellm", "versions": [{"status": "affected", "version": "< 1.83.10-stable"}]}], "references": [{"url": "https://github.com/BerriAI/litellm/security/advisories/GHSA-4g5m-c9r5-49xf", "name": "https://github.com/BerriAI/litellm/security/advisories/GHSA-4g5m-c9r5-49xf", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/BerriAI/litellm/pull/25592", "name": "https://github.com/BerriAI/litellm/pull/25592", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable", "name": "https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.10-stable, LiteLLM's /health/test_connection endpoint resolved request-supplied environment and OIDC file references in litellm_params, allowing a proxy administrator or another privileged caller with permission to test model connections to read files from the local filesystem via an oidc/file/ reference. This issue is fixed in version 1.83.10-stable."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-73", "description": "CWE-73: External Control of File Name or Path"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-08T19:33:32.816Z"}}}, "cveMetadata": {"cveId": "CVE-2026-59819", "state": "PUBLISHED", "dateUpdated": "2026-07-09T14:30:14.779Z", "dateReserved": "2026-07-07T15:00:50.978Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-08T19:33:32.816Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "litellm", "vendor": "BerriAI", "versions": [{"status": "affected", "version": "< 1.83.10-stable"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:*", "matchCriteriaId": "25EE35DD-B093-4808-97CD-3FC6BF332D7C", "versionEndExcluding": "1.83.10", "vulnerable": true}, {"criteria": "cpe:2.3:a:litellm:litellm:1.83.10:nightly:*:*:*:*:*:*", "matchCriteriaId": "465E1E6D-C056-4DFF-80BE-73244D6D8776", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.10-stable, LiteLLM's /health/test_connection endpoint resolved request-supplied environment and OIDC file references in litellm_params, allowing a proxy administrator or another privileged caller with permission to test model connections to read files from the local filesystem via an oidc/file/ reference. This issue is fixed in version 1.83.10-stable."}, {"lang": "es", "value": "LiteLLM es un servidor proxy (Pasarela de IA) para llamar a las API de LLM en formato OpenAI (o nativo). Antes de la versi\u00f3n 1.83.10-stable, el endpoint /health/test_connection de LiteLLM resolv\u00eda referencias de archivos OIDC y de entorno suministradas en la solicitud en litellm_params, permitiendo a un administrador de proxy o a otro llamador privilegiado con permiso para probar conexiones de modelos leer archivos del sistema de archivos local a trav\u00e9s de una referencia oidc/file/. Este problema est\u00e1 solucionado en la versi\u00f3n 1.83.10-stable."}], "id": "CVE-2026-59819", "lastModified": "2026-10-25T17:10:00.197", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59819", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-09T14:30:04.946174Z", "version": "2.0.3"}}]}, "published": "2026-07-08T20:16:57.277", "references": [{"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/BerriAI/litellm/pull/25592"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "url": "https://github.com/BerriAI/litellm/security/advisories/GHSA-4g5m-c9r5-49xf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-73"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "litellm: LiteLLM: Information disclosure via local file read in test connection endpoint", "id": "2498192", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498192"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-22", "details": ["LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.10-stable, LiteLLM's /health/test_connection endpoint resolved request-supplied environment and OIDC file references in litellm_params, allowing a proxy administrator or another privileged caller with permission to test model connections to read files from the local filesystem via an oidc/file/ reference. This issue is fixed in version 1.83.10-stable.", "A flaw was found in LiteLLM, a proxy server for Large Language Model (LLM) APIs. A privileged caller, such as a proxy administrator, with permissions to test model connections, could exploit the /health/test_connection endpoint. By supplying specific environment or OIDC (OpenID Connect) file references, an attacker could read arbitrary files from the local filesystem. This unauthorized file access could lead to information disclosure."], "mitigation": {"lang": "en:us", "value": "Upgrade to litellm >= 1.83.14. If upgrading is not immediately possible, restrict network access to the LiteLLM Proxy Server administrative API (including /health/test_connection) to trusted, authenticated proxy/team administrators only, and avoid setting LITELLM_OIDC_ALLOWED_CREDENTIAL_DIRS or OIDC file secret providers to sensitive filesystem paths."}, "name": "CVE-2026-59819", "package_state": [{"cpe": "cpe:/a:redhat:exploit_intelligence:0", "fix_state": "Not affected", "package_name": "exploit-intelligence-tech-preview/vulnerability-analysis-rhel9", "product_name": "Exploit Intelligence"}, {"cpe": "cpe:/a:redhat:lightspeed_core", "fix_state": "Not affected", "package_name": "lightspeed-core/lightspeed-stack-rhel9", "product_name": "Lightspeed Core"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Not affected", "package_name": "ansible-automation-platform-26/lightspeed-chatbot-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Not affected", "package_name": "ansible-automation-platform-27/lightspeed-chatbot-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-llama-stack-core-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-mlflow-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-07-08T19:33:32Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-59819\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-59819\nhttps://github.com/BerriAI/litellm/pull/25592\nhttps://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable\nhttps://github.com/BerriAI/litellm/security/advisories/GHSA-4g5m-c9r5-49xf"], "statement": "LiteLLM Proxy Server exposes a POST /health/test_connection endpoint that resolves os.environ/ references supplied in request parameters and reads OIDC credential files via the oidc/file/ secret provider without restricting the file path to an approved credentials directory. A caller with access to this endpoint could read local environment variable values or arbitrary files reachable via a crafted OIDC file reference, resulting in information disclosure. This is fixed upstream in litellm 1.83.14, which rejects os.environ/ references in request parameters and enforces an allow-listed OIDC credential directory. Red Hat components that use the litellm Python package only as an LLM client library (litellm.completion()/litellm.acompletion() and similar), without running the LiteLLM Proxy Server, do not expose this endpoint and are not affected.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.83.10-stable)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "litellm", "source": "cna", "vendor": "BerriAI"}, "product": "litellm", "vendor": "berriai"}], "created": "2026-07-08T21:00:06.520004+00:00", "updated": "2026-08-01T16:00:05.119024+00:00", "vendors": ["berriai", "berriai$PRODUCT$litellm"]}