LiteLLM CVE-2026-59819

Exploitation requires the attacker to hold a proxy administrator role or equivalent privileged caller permission that grants access to the /health/test_connection endpoint - this is explicitly stated in the vulnerability description as the required privilege level. The CVSS 4.0 AT:P metric further indicates a specific attack requirement beyond normal configuration: the caller must have permission specifically to test model connections, which may be a separately grantable capability in LiteLLM's access model. Limiting factors include: (1) PR:H - standard authenticated user accounts without admin rights cannot trigger this; (2) AT:P - even among admins, test-connection permission may not be universally granted; (3) impact is read-only (VC:L), with no integrity or availability consequence. Exploitation is not automatable at scale and requires an attacker who has already achieved administrative access to the LiteLLM proxy.

Real-world risk is low, well-aligned with the CVSS 4.0 score of 2.1. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N) highlights two critical limiters: PR:H requires the attacker to already be an authenticated proxy administrator or another caller explicitly granted test-connection permission, and AT:P signals an additional attack requirement beyond standard configuration (the caller must have access to the specific /health endpoint and permission to invoke it). The VC:L rating reflects that file contents may be limited in sensitivity depending on filesystem permissions and deployment layout. No EPSS data was provided in the intelligence feed; however, given PR:H and the specialized attacker profile required, opportunistic mass exploitation is implausible. This vulnerability is absent from the CISA KEV catalog and no public exploit code has been identified. The primary realistic risk is insider threat or a compromised administrator account pivoting to credential file exfiltration - for example, reading service account tokens or API key files stored on the proxy host.

An authenticated proxy administrator logs into the LiteLLM management interface and invokes /health/test_connection with a crafted litellm_params payload containing an oidc/file//etc/passwd or oidc/file//path/to/api_keys reference. The server resolves the path against the local filesystem and returns the file contents within the connection test response, allowing the attacker to harvest credentials or sensitive configuration files stored on the proxy host. No public exploit code has been identified; exploitation requires valid administrative credentials.