LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.10-stable, LiteLLM's /health/test_connection endpoint resolved request-supplied environment and OIDC file references in litellm_params, allowing a proxy administrator or another privileged caller with permission to test model connections to read files from the local filesystem via an oidc/file/ reference. This issue is fixed in version 1.83.10-stable.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to
    1.83.10-stable, LiteLLM's /health/test_connection endpoint resolved request-supplied environment and OIDC
    file references in litellm_params, allowing a proxy administrator or another privileged caller with
    permission to test model connections to read files from the local filesystem via an oidc/file/ reference.
    This issue is fixed in version 1.83.10-stable. (CVE-2026-59819)

ID	Name	Product	Family	Type	Severity
458544	Echo: litellm: security update to 1.83.10	Tenable Cloud Security	Echo Local Security Checks	Local	low
458544	Echo: litellm: security update to 1.83.10	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	low
445188	SCA: security update for litellm (GHSA-4g5m-c9r5-49xf)	Tenable Cloud Security	SCA Checks	Local	low
445188	SCA: security update for litellm (GHSA-4g5m-c9r5-49xf)	Tenable Self-Hosted Container Security	SCA Checks	Local	low

Detections

Analytics

CVE-2026-59819

low

Tenable Plugins

low

low

low

low