CVE-2026-59819: LiteLLM File Disclosure via /health/test_connection Endpoint

Technical summary

CVE-2026-59819 is a path traversal and file disclosure vulnerability in LiteLLM's `/health/test_connection` endpoint. The endpoint improperly resolves environment variable and OIDC file references embedded in litellm_params without adequate input validation or sanitization. An attacker supplying an oidc/file/ reference can read arbitrary files from the local filesystem where LiteLLM runs. The vulnerability requires authentication and administrative privileges, but the barrier to exploitation is low once that access is obtained. The fix in version 1.83.10-stable implements proper validation of parameter resolution to prevent unintended file access.

Business impact

This vulnerability poses a moderate but meaningful risk to organizations operating LiteLLM as a centralized API gateway. Compromise of LiteLLM configuration files, API keys, secrets, or other sensitive data stored on the same server could lead to broader infrastructure compromise. In multi-tenant or managed service scenarios, this becomes a data isolation issue. The required administrative privilege level limits the attack surface, but insider threats and compromised administrative accounts represent real risks. Organizations relying on LiteLLM for credential management should treat this as a priority patching target to protect downstream API credentials and application secrets.

Affected systems

LiteLLM versions prior to 1.83.10-stable are affected. Organizations running LiteLLM as an AI gateway or LLM proxy should verify their deployed version immediately. The vulnerability specifically impacts the `/health/test_connection` endpoint, so systems that do not expose or actively use this endpoint for external testing still carry the risk if internal processes call it. Any deployment where untrusted or semi-trusted users have proxy administrator privileges warrants urgent remediation.

Exploitability

Exploitation requires valid authentication and high-level privileges (proxy administrator or equivalent). The attack is straightforward once those privileges are obtained: an attacker simply crafts an HTTP request to the `/health/test_connection` endpoint with a malicious oidc/file/ parameter pointing to a target file. No interaction is needed; the file content is returned in the response. This makes it attractive to insider threats or to attackers who have compromised an administrative account through phishing or credential theft. Exploitation does not require sophisticated tooling and leaves little forensic evidence beyond API logs.

Remediation

Upgrade LiteLLM to version 1.83.10-stable or later immediately. The upgrade should be straightforward; verify compatibility with your environment before deployment. In parallel, audit logs of the `/health/test_connection` endpoint to identify any suspicious requests with oidc/file/ parameters. Review who holds proxy administrator privileges and ensure access is minimized and monitored. Consider implementing network segmentation or API gateway controls to restrict external access to the `/health/test_connection` endpoint if it is not required for external use.

Patch guidance

Deploy version 1.83.10-stable or later. Test the upgrade in a non-production environment first to ensure no compatibility issues with your existing model configurations or calling applications. The fix validates parameter resolution, so configuration files that previously worked should continue to function. If you use automated deployment pipelines, prioritize this update for immediate rollout. Document the patched version in your asset inventory and re-run any vulnerability scans to confirm remediation.

Detection guidance

Monitor access logs to the `/health/test_connection` endpoint, particularly requests from unexpected IP ranges or with unusual litellm_params payloads. Look for patterns like `oidc/file/`, `file://`, or path traversal sequences (`../`) in request bodies or parameters. Implement alerting on API endpoints that are rarely or never accessed from external sources; the `/health/test_connection` endpoint is typically for internal health checks. Inspect LiteLLM configuration files and audit trails for any evidence of unauthorized file read attempts. Network-based detection is difficult without payload inspection, so focus on application and API logging.

Why prioritize this

Although assigned a MEDIUM severity score reflecting the requirement for high privileges, this vulnerability warrants prompt attention because it directly compromises confidentiality of sensitive data stored on the LiteLLM server (API keys, credentials, configuration secrets). The ease of exploitation once privileges are obtained and the common practice of storing secrets near application code make this a realistic attack scenario. Organizations using LiteLLM in production should treat this as a priority patch alongside other critical updates; it should not be deferred to the next maintenance window.

Risk score, explained

The CVSS 3.1 score of 4.9 reflects a MEDIUM severity rating. The score correctly penalizes the requirement for high privileges (PR:H) but recognizes high confidentiality impact (C:H) and network-based attack surface (AV:N/AC:L). The lack of integrity and availability impact is appropriate because the vulnerability allows reading files only, not modifying them or causing denial of service. This scoring appropriately reflects that the risk is elevated for organizations that maintain sensitive data on LiteLLM servers and have distributed administrative privileges, but lower for isolated or tightly controlled deployments.

Frequently asked questions