CVE-2026-59819: LiteLLM: Local file read via request-supplied OIDC file references
Impact
LiteLLM's /health/testconnection endpoint resolved request-supplied environment and OIDC file references in litellmparams. A proxy administrator, or another privileged caller with permission to test model connections, could cause LiteLLM to read files from the local filesystem via an oidc/file/ reference.
Because exploitation requires privileged proxy access, this is treated as a defense-in-depth issue rather than a cross-tenant privilege bypass.
Patches
The issue is fixed in 1.83.10-stable.
LiteLLM recommend upgrading to 1.83.10-stable or later.
Workarounds
Restrict /health/testconnection access to trusted administrators only.
Other sources
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.10-stable, LiteLLM's /health/testconnection endpoint resolved request-supplied environment and OIDC file references in litellmparams, allowing a proxy administrator or another privileged caller with permission to test model connections to read files from the local filesystem via an oidc/file/ reference. This issue is fixed in version 1.83.10-stable.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/litellmto a version that resolves this vulnerability.Fixed in 1.83.10 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.83.10-stable - Configuration
Restrict LiteLLM's /health/test_connection endpoint to trusted administrators only to prevent privileged callers from exploiting request-supplied environment and OIDC file references in litellm_params for local file reads via an oidc/file/ reference.
LiteLLM (proxy server) /health/test_connection endpoint access control = trusted administrators only
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59819?
The severity of CVE-2026-59819 is low, with a CVSS score of 4.0.
What does CVE-2026-59819 allow an attacker to do?
CVE-2026-59819 allows an attacker to read local files via request-supplied OIDC file references in LiteLLM's parameters.
How do I fix CVE-2026-59819?
To fix CVE-2026-59819, update LiteLLM to version 1.83.10-stable or later.
Which software is affected by CVE-2026-59819?
LiteLLM versions prior to 1.83.10-stable are affected by CVE-2026-59819.
When was CVE-2026-59819 published?
CVE-2026-59819 was published on July 8, 2026.