LiteLLM Local File Read via OIDC File Reference in test_connection Endpoint

Technical Analysis

The /health/test_connection endpoint accepted request-supplied environment and OIDC file references within litellm_params and resolved them without adequately restricting the file paths, allowing an authorized caller to coerce the LiteLLM proxy into reading arbitrary files from its local filesystem. The entry point is an authenticated administrative API used to validate model connections, meaning the attacker must already hold privileges to call it. The primary gain is disclosure of local file contents (e.g., secrets, config files) accessible to the LiteLLM process, without any indication of remote code execution or lateral movement into other agents/tenants. This does not cross agent-to-agent trust boundaries but does represent a privilege-abuse pathway within a single trusted administrative surface.

Affected Systems

LiteLLM

Detection Signatures

• Requests to /health/test_connection containing litellm_params with oidc/file/ prefixed values
• Unexpected file read attempts originating from LiteLLM proxy health-check code paths
• Audit logs showing test_connection calls referencing paths outside expected credential/config directories

Remediation Steps

1. 1

   Upgrade LiteLLM

   Update to litellm 1.83.10-stable or later, which fixes the unrestricted file reference resolution.

2. 2

   Restrict endpoint access

   Limit access to /health/test_connection to trusted, fully authenticated administrators only, as a workaround until upgraded.

3. 3

   Audit privileged API usage

   Review logs for any historical test_connection calls using oidc/file/ or environment file references to identify potential prior misuse.

4. 4

   Apply least privilege

   Ensure proxy administrator roles are minimized and scoped, reducing the pool of accounts capable of triggering this endpoint.