CVE-2026-59819 LiteLLM: Local file read via request-supplied OIDC file references
Privileged users can read local files via OIDC file references in the health test connection endpoint of the LiteLLM proxy server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59819?
CVE-2026-59819 is a low-severity path traversal vulnerability in BerriAI litellm, published on 8 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.10-stable, LiteLLM's /health/test_connection endpoint resolved request-supplied environment and OIDC file references in litellm_params, allowing a proxy administrator or another privileged caller with permission to test model connections to read files from the local filesystem via an oidc/file/ reference. This issue is fixed in version 1.83.10-stable.
Weakness: CWE-73
Which versions are affected by CVE-2026-59819?
3 open source packages ship an affected version, including litellm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
litellm PyPI | All versions | 1.83.10 |
litellm PyPI | All versions | 1.83.10 |
litellm PyPI | All versions | 1.83.10 |
Products include Litellm Litellm.
How do I fix CVE-2026-59819?
Upgrade litellm to 1.83.10 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-59819 being exploited?
There is no known exploitation of CVE-2026-59819 in the wild and no public exploit code.
Other vulnerabilities in BerriAI litellm
Sources
Also known as ECHO-ab2a-73d9-3aa2, GHSA-4g5m-c9r5-49xf, MINI-4p87-r3j3-f39c, MINI-76cr-gqm7-q44w, MINI-jprv-grp2-jhxf, MINI-m95w-3j6m-fmm4 and 3 more.