L3 · ShartedLiteLLM · credentials · Enterpriselitellm-enterprise-file-read

LiteLLM Enterprise proxy file-read flaw can expose the master key without authentication

An Enterprise-licensed LiteLLM proxy can leak local files through an unauthenticated LLM request, enabling admin access and, in some configurations, root code execution. Update to a patched release; unlicensed OSS deployments are unaffected.

Disclosed: Oct 27, 2026; Public disclosure date
Severity: CVSS 10; 1 CVE tracked here
Splash zone: Enterprise-licensed proxies reachable over HTTP; exfiltration requires outbound access to an attacker endpoint; litellm
In the wild: Unknown; The advisory does not establish exploitation in the wild.

What happened

This is a separate advisory from the October 21 release compromise. An active Enterprise license loads the vulnerable paths; a request can send local file contents to a chosen token endpoint. Environment-held master and provider keys are exposed if read. Root execution is conditional, not guaranteed for every proxy. L3 reflects an unauthenticated administrator-access flaw in a widely used gateway without confirmed real-world exploitation or a victim total.

What’s in the bowl

GHSA-w4c7-34wj-hqm8CVSS 10

Enterprise proxy unauthenticated file read

Local-file exfiltration can expose the master key and allow proxy administration; host code execution depends on configuration.

Fixed versions

Product	Safe from	Note
LiteLLM 1.103	`1.103.10`
LiteLLM 1.104	`1.104.8`
LiteLLM 1.105	`1.105.6`
LiteLLM 1.106	`1.106.5`

Crime-scene timeline

Oct 6, 2026
Vendor distributes private fixes to Enterprise customers
Oct 27, 2026
Embargo ends; advisory and public patched builds released

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

LiteLLM Enterprise advisoryPrimaryEnterprise-only prerequisites, four fixed versions, CVSS 10.0, five trigger keys and mitigations; no CVE listed.
LiteLLM private-registry disclosurePrimaryPrivate fix October 6; public embargo ends October 27; confirms versions and limited Enterprise scope.

Wipe guide

The wipe checklist

0 of 3 sheets used

Update the licensed proxySelect the matching patched release above from verified official channels; the October 21 rollback version 1.106.2 does not fix this separate Enterprise flaw.
Block the trigger and constrain network pathsAt ingress, reject POST bodies containing any of these JSON keys: standard_callback_dynamic_params, gcs_path_service_account, callbacks, success_callback and failure_callback. Allow outbound traffic only to configured LLM providers; use VPN, mTLS, authenticating ingress or an IP allowlist for access.
Reduce secret exposure and investigate reachable credentialsLoad the master key from a secret manager, set a separate LITELLM_SALT_KEY, and review suspected file access/exfiltration, including /proc/self/environ. General incident-response guidance: preserve logs and rotate master/provider keys if exposure is found; no campaign-specific indicators are published.