Skip to content
VulniPulse
Sign in
Advisory severityMedium4.9Red Hat Linux

Medium [CVE-2026-59819] Information disclosure via local file read in test connection endpoint

This medium-severity Red Hat Linux advisory covers CVE-2026-59819.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-59819 Source published Source updated

VulniPulse record published Record updated

CVE-2026-59819
Affected products & platforms
Red Hat LinuxUnclassified
Open source advisory

Summary

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format.

Prior to 1.83.10-stable, LiteLLM's /health/test_connection endpoint resolved request-supplied environment and OIDC file references in litellm_params, allowing a proxy administrator or another privileged caller with permission to test model connections to read files from the local filesystem via an oidc/file/ reference.

This issue is fixed in version 1.83.10-stable. A flaw was found in LiteLLM, a proxy server for Large Language Model (LLM) APIs.

This unauthorized file access could lead to information disclosure. LiteLLM Proxy Server exposes a POST /health/test_connection endpoint that resolves os.environ/ references supplied in request parameters and reads OIDC credential files via the oidc/file/ secret provider without restricting the file path to an approved credentials directory.

Red Hat components that use the litellm Python package only as an LLM client library (litellm.completion()/litellm.acompletion() and similar), without running the LiteLLM Proxy Server, do not expose this endpoint and are not affected. Red Hat severity: Moderate — CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).

Weakness: CWE-22. Red Hat lists Exploit Intelligence; Lightspeed Core; Red Hat Ansible Automation Platform 2; Red Hat OpenShift AI (RHOAI) as not affected.

Is CVE-2026-59819 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-59819 is not in the CISA KEV catalog (checked ) and this advisory does not report exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-59819?

Upgrade to a fixed release named by Red Hat:

  • 1.83.10
  • 1.83.10-stable

Confirm against the vendor advisory before you patch.

Affected versions
  • < 1.83.10-stable

Official advisory · high-confidence parse· fetched 11 days ago·verify at source

Fixed versions
  • 1.83.10
  • 1.83.10-stable

Official advisory · high-confidence parse· fetched 11 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • Upgrade to litellm >= 1.83.14. If upgrading is not immediately possible, restrict network access to the LiteLLM Proxy Server administrative API (including /health/test_connection) to trusted, authenticated proxy/team administrators only, and avoid setting LITELLM_OIDC_ALLOWED_CREDENTIAL_DIRS or OIDC file secret providers to sensitive filesystem paths.

Official advisory · high-confidence parse· fetched 11 days ago·verify at source

Get an email when Red Hat publishes the next one.

See Red Hat's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Red Hat

More Red Hat Linux advisories

All Red Hat Linux advisories

iPhone and Android apps · New on the App Store

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Download on the App StoreGet CVE alerts on AndroidSee app features

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.