# LiteLLM GHSA-g5ff-637f-6q2m: a viewer account can read files off the proxy, upgrade to 1.95.0

LiteLLM's October 1, 2026 advisory rates an arbitrary file read High (CVSS 8.1, no CVE): an authenticated internal_user_viewer can pull environment variables and API keys off the proxy. Versions before 1.95.0 are affected and there is no configuration workaround.

By Neomanex. Updated 2026-10-27.

**Our verdict on [LiteLLM](/directory/litellm) stays conditional.** It is still the strongest free default for one OpenAI-format API over many providers, but this advisory shows the condition is real: a viewer-level account on an unpatched proxy can read the files that hold your keys. Upgrade to 1.95.0 or later now.

## What happened

LiteLLM's GitHub security advisory GHSA-g5ff-637f-6q2m, published October 1, 2026, rates the flaw High with a CVSS score of 8.1. No CVE has been assigned. We re-read the advisory page on October 27, 2026.

- **Who can exploit it:** an authenticated user holding only the internal_user_viewer role.
- **Where:** the /utils/transform_request endpoint.
- **Root cause:** the request-body blocklist rejected vertex_credentials but missed its alias, vertex_ai_credentials, which let the value reach the Vertex AI credential loader.
- **Impact:** the attacker can read any file readable by the LiteLLM process. Environment files can expose LITELLM_MASTER_KEY and provider API keys, which can escalate to full proxy admin control.
- **Affected:** versions before 1.95.0. **Patched:** 1.95.0.
- **Workaround:** none. The advisory states there is no reliable configuration workaround on affected versions, and no configuration change is needed once you upgrade.

## Why it matters

This is the second LiteLLM advisory in two days. On September 30, 2026, GHSA-7hp6-4w63-5g45 (Critical, CVSS 9.9) described a privilege escalation to proxy admin by an authenticated internal_user, caused by reusing one key for sealing secrets and for session tokens.

Both need only a low-privilege authenticated account. Your exposure therefore scales with two numbers: how many people hold keys on your proxy, and how long you run an old build. A gateway that sits in front of every provider key is the worst place to have a read-anything bug.

## What changes for you

- **Upgrade to 1.95.0 or later.** That closes this file read.
- **Check the other advisory too.** 1.95.0 alone does not cover GHSA-7hp6-4w63-5g45, which affects 1.91.0 up to 1.100.4 (plus several later release lines). Its patched builds are 1.100.4, 1.101.3, 1.102.2, 1.103.1 and 1.104.0rc2.
- **Rotate secrets** if any internal_user_viewer account was shared or untrusted on an affected build: the master key and every provider key the process could read.
- **Audit internal accounts.** Remove viewer and internal users who do not need access.
- **Pin versions and patch within days.** That is the discipline our conditional verdict assumes.

We have not deployed LiteLLM ourselves, so this is a reading of the advisories, not a reproduction.

Canonical: https://neomanex.com/news/litellm-ghsa-g5ff-637f-6q2m-file-read-advisory