LiteLLM: internal_user_viewer arbitrary local file read via vertex_ai_credentials

# LiteLLM: internal_user_viewer arbitrary local file read via vertex_ai_credentials

https://gcdradar.vercel.app/incidents/litellm-internal-user-viewer-arbitrary-local-file-read-via-v · AIR-2026-1589 · closed 2026-10-27

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability): Disclosed vulnerability with a security advisory; no exploitation confirmed.
- Fix status: Fix status unknown
- First reported: 2026-10-27
- AI role: Attack on AI
- Products: LiteLLM
- CVSS: 8.1

## Summary

An authenticated low-privilege user can read arbitrary local files on the proxy runtime by sending a crafted vertex_ai_credentials value. The value reaches the Vertex AI credential loader and triggers an unintended file read.

## What to do

Check the advisory for fixed versions and update LiteLLM.

## Affected and fixed versions

- Affected: litellm < 1.95.0
- Fixed in: litellm 1.95.0

## Latest updates

- 2026-10-27: GHSA-g5ff-637f-6q2m: LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials` (https://github.com/advisories/GHSA-g5ff-637f-6q2m)

## Sources

- 2026-10-27 GitHub Advisory Database: GHSA-g5ff-637f-6q2m: LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials` https://github.com/advisories/GHSA-g5ff-637f-6q2m

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.