CVE-2026-59819: LiteLLM admin-scope local file read

CISO Take

LiteLLM's /health/test_connection endpoint resolves file references embedded in litellm_params without confining the caller to expected paths, letting a proxy administrator or another privileged caller with model-testing permissions read arbitrary files from the underlying host via a crafted oidc/file/ reference. This isn't a pre-auth flaw — it requires existing privileged access to the LiteLLM proxy — but it matters because AI gateways like LiteLLM sit in front of dozens of model providers and often hold OIDC tokens, cloud credentials, and service-account files on disk, all of which become exposed to a malicious or compromised admin account; EPSS sits at just 0.28% with no CISA KEV listing, public exploit, or Nuclei template, so mass opportunistic exploitation is not a near-term concern. The real risk is insider misuse or lateral movement after an attacker has already compromised an operator or CI credential holding proxy-admin rights. Patch to 1.83.10-stable immediately, and in the interim restrict who can invoke /health/test_connection and audit which accounts hold model-connection-testing permissions, since this is fundamentally a privilege-boundary bug inside an already-trusted role.

Sources: NVD GitHub Advisory EPSS ATLAS

What is the risk?

Moderate but contained. Impact is high if exploited (arbitrary local file read can expose credentials, OIDC secrets, and configuration), but likelihood is reduced by the requirement for pre-existing privileged access (proxy admin or a caller scoped to test model connections). No CISA KEV listing, no public exploit code, no Nuclei template, and an EPSS score of 0.00278 all indicate this is not being actively or opportunistically exploited. The primary threat model is insider abuse or an attacker who has already compromised a privileged account, not an unauthenticated internet-facing attack.

How does the attack unfold?

Privileged Access Precondition

Attacker obtains or already holds proxy administrator credentials, or a role scoped to invoke model connection testing, via insider access or prior credential compromise.

Craft OIDC File Reference

Attacker submits a request to /health/test_connection with litellm_params containing a crafted oidc/file/ reference pointing at a sensitive local file instead of a legitimate OIDC config.

AML.T0037

Arbitrary File Disclosure

LiteLLM resolves the file reference and returns or processes its contents, exposing local filesystem data such as credentials, environment files, or service-account secrets.

AML.T0055

Credential-Enabled Pivot

Attacker uses the disclosed secrets to authenticate to cloud infrastructure or downstream LLM provider accounts, expanding the compromise beyond the proxy itself.

Privileged Access Precondition

Attacker obtains or already holds proxy administrator credentials, or a role scoped to invoke model connection testing, via insider access or prior credential compromise.

Craft OIDC File Reference

Attacker submits a request to /health/test_connection with litellm_params containing a crafted oidc/file/ reference pointing at a sensitive local file instead of a legitimate OIDC config.

AML.T0037

Arbitrary File Disclosure

LiteLLM resolves the file reference and returns or processes its contents, exposing local filesystem data such as credentials, environment files, or service-account secrets.

AML.T0055

Credential-Enabled Pivot

Attacker uses the disclosed secrets to authenticate to cloud infrastructure or downstream LLM provider accounts, expanding the compromise beyond the proxy itself.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LiteLLM	pip	< 1.83.10	`1.83.10`
57.0K OpenSSF 5.8 6 dependents Pushed 3d ago 49% patched ~47d to patch Full package profile →

Do you use LiteLLM? You're affected.

How severe is it?

CVSS 3.1

4.9 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 37% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR High

UI None

S Unchanged

C High

I None

A None

What should I do?

1 step

Upgrade to litellm >=1.83.10-stable immediately — this is the definitive fix. Until patched: restrict who can call /health/test_connection to a minimal set of trusted admins, avoid granting model-connection-testing permission broadly or to CI/automation accounts, and review audit logs for test-connection requests containing oidc/file/ references or unexpected litellm_params values. As a precaution, rotate credentials and secrets that were readable by the host process running the vulnerable LiteLLM version, and ensure the proxy process runs with least-privilege filesystem access so it cannot read unrelated secrets directories even if this class of bug recurs.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Leakage Data Extraction API Framework AML.T0037 - Data from Local System AML.T0055 - Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

NIST AI RMF

MANAGE 2.3 - Third-party AI system risk response

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-59819?

LiteLLM's /health/test_connection endpoint resolves file references embedded in litellm_params without confining the caller to expected paths, letting a proxy administrator or another privileged caller with model-testing permissions read arbitrary files from the underlying host via a crafted oidc/file/ reference. This isn't a pre-auth flaw — it requires existing privileged access to the LiteLLM proxy — but it matters because AI gateways like LiteLLM sit in front of dozens of model providers and often hold OIDC tokens, cloud credentials, and service-account files on disk, all of which become exposed to a malicious or compromised admin account; EPSS sits at just 0.28% with no CISA KEV listing, public exploit, or Nuclei template, so mass opportunistic exploitation is not a near-term concern. The real risk is insider misuse or lateral movement after an attacker has already compromised an operator or CI credential holding proxy-admin rights. Patch to 1.83.10-stable immediately, and in the interim restrict who can invoke /health/test_connection and audit which accounts hold model-connection-testing permissions, since this is fundamentally a privilege-boundary bug inside an already-trusted role.

Is CVE-2026-59819 actively exploited?

No confirmed active exploitation of CVE-2026-59819 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-59819?

Upgrade to litellm >=1.83.10-stable immediately — this is the definitive fix. Until patched: restrict who can call /health/test_connection to a minimal set of trusted admins, avoid granting model-connection-testing permission broadly or to CI/automation accounts, and review audit logs for test-connection requests containing oidc/file/ references or unexpected litellm_params values. As a precaution, rotate credentials and secrets that were readable by the host process running the vulnerable LiteLLM version, and ensure the proxy process runs with least-privilege filesystem access so it cannot read unrelated secrets directories even if this class of bug recurs.

What systems are affected by CVE-2026-59819?

This vulnerability affects the following AI/ML architecture patterns: AI gateway / LLM proxy, multi-provider LLM routing, model serving.

What is the CVSS score for CVE-2026-59819?

CVE-2026-59819 has a CVSS v3.1 base score of 4.9 (MEDIUM). The EPSS exploitation probability is 0.45%.

What is the AI security impact?

Affected AI Architectures

AI gateway / LLM proxymulti-provider LLM routingmodel serving

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0055 Unsecured Credentials

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.10-stable, LiteLLM's /health/test_connection endpoint resolved request-supplied environment and OIDC file references in litellm_params, allowing a proxy administrator or another privileged caller with permission to test model connections to read files from the local filesystem via an oidc/file/ reference. This issue is fixed in version 1.83.10-stable.

Exploitation Scenario

An insider, or an attacker who has phished or stolen credentials for a LiteLLM proxy admin account, uses their legitimate 'test connection' permission to call /health/test_connection with litellm_params pointing at a crafted file reference (e.g., oidc/file//app/.env or oidc/file//etc/passwd) instead of a genuine OIDC config path. LiteLLM resolves the reference and returns or otherwise processes the file's contents as part of the connection-test response, disclosing sensitive host data — other services' credentials, cloud secrets, SSH keys — without requiring any additional exploit chain. The attacker then uses those harvested secrets to pivot into cloud infrastructure or downstream LLM provider accounts, turning a narrowly scoped admin testing feature into a springboard for broader compromise.

Weaknesses (CWE)

CWE-73 External Control of File Name or Path Primary CWE-73 External Control of File Name or Path Primary CWE-73 External Control of File Name or Path

CWE-73 — External Control of File Name or Path: The product allows user input to control or influence paths or file names that are used in filesystem operations.

[Architecture and Design] When the set of filenames is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap provide this capability.
[Architecture and Design, Operation] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict all access to files within a particular directory. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.