Is there a patch available for CVE-2026-59819?

Yes, a patch is available for CVE-2026-59819. Update the affected software to the latest version immediately.

LiteLLM CVE-2026-59819

Q: What is the CVSS score of CVE-2026-59819?

CVE-2026-59819 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42361 LOW

External Control of File Name or Path (CWE-73)

2026-07-08 GitHub_M

GHSA-4g5m-c9r5-49xf

Information Disclosure Litellm Berriai

2.1

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

2.7 LOW

Network-reachable endpoint but requires high privileges (proxy admin); confidentiality impact is low as only partial file read applies with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 08, 2026 - 21:04 EUVD

Analysis Generated

Jul 08, 2026 - 20:49 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

15 pypi packages depend on litellm (14 direct, 1 indirect)

Ecosystem-wide dependent count for version 1.83.10.

DescriptionCVE.org

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.10-stable, LiteLLM's /health/test_connection endpoint resolved request-supplied environment and OIDC file references in litellm_params, allowing a proxy administrator or another privileged caller with permission to test model connections to read files from the local filesystem via an oidc/file/ reference. This issue is fixed in version 1.83.10-stable.

AnalysisAI

Local filesystem read in LiteLLM's AI Gateway proxy prior to version 1.83.10-stable allows a proxy administrator to exfiltrate files from the server by supplying crafted oidc/file/ path references through the /health/test_connection endpoint. The vulnerability stems from unsanitized resolution of request-supplied environment and OIDC file references within litellm_params, giving a high-privileged caller a direct path to arbitrary file read. No public exploit code or active exploitation has been identified; the low CVSS 4.0 score of 2.1 reflects the high privilege bar and limited confidentiality impact.

Technical ContextAI

LiteLLM (CPE: cpe:2.3:a:berriai:litellm:*:*:*:*:*:*:*:*) is an open-source Python-based AI Gateway that proxies requests to multiple LLM provider APIs using OpenAI-compatible formatting. The affected component is its /health/test_connection endpoint, which accepts model configuration parameters (litellm_params) and uses them to validate connectivity. CWE-73 (Improper Neutralization of External Input Used by a Downstream Component, also known as External Control of File Name or Path) describes the root cause: user-supplied strings in litellm_params are passed directly to a file resolution routine that supports both environment variable substitution and OIDC credential file references via the oidc/file/ URI scheme. The server resolves these references against the local filesystem without restricting the path, effectively turning the connection test into a server-side file read primitive.

RemediationAI

Upgrade to LiteLLM version 1.83.10-stable or later, which contains the fix as described in GitHub Security Advisory GHSA-4g5m-c9r5-49xf and merged via pull request https://github.com/BerriAI/litellm/pull/25592; the release is available at https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable. If immediate upgrade is not feasible, restrict access to the /health/test_connection endpoint at the network perimeter or API gateway layer to only trusted administrator IP ranges, reducing the pool of callers who could supply malicious litellm_params. Additionally, review and tighten proxy administrator role membership, applying the principle of least privilege so that only operationally required accounts hold test-connection permission. Note that network-layer blocking of /health/test_connection will prevent legitimate connectivity diagnostics - assess operational impact before applying this workaround.