Bug 2564725 (CVE-2026-123061)

Summary: CVE-2026-123061 litellm: litellm: unauthenticated arbitrary file read leading to master key leakage and remote code execution
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: unspecifiedCC: dschmidt, ebourniv, hasun, ilpinto, jlanda, jwong, kshier, ltomasbo, mhayden, nyancey, omaciel, ptisnovs, rbobbitt, sbunciak, sdoran, simaishi, stcannon, tguha, ttakamiy, yguenane, ykashtan
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A critical vulnerability was discovered in LiteLLM Enterprise proxy where an unauthenticated remote attacker can trigger an arbitrary file read on any LLM route. This flaw allows an attacker to leak the proxy's master key (LITELLM_MASTER_KEY) and third-party model provider API credentials. With administrative proxy access obtained via the leaked master key, attackers can, in certain configurations, achieve remote code execution as root.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-02 08:25:30 UTC 
An unauthenticated request to any LLM route on a LiteLLM proxy running with an Enterprise license could make the proxy read a local file and send its contents to a URL chosen by the attacker. Reading a file like /proc/self/environ exposes LITELLM_MASTER_KEY and provider API keys, which gives the attacker full admin access to the proxy. In some configurations, this allows the attacker to then execute arbitrary python code as root.

Open source deployments without a license are not affected, because the relevant codepaths only load when an Enterprise license is active. As defense in depth, we also recommend loading the master key from a secret manager instead of the process environment, setting a separate LITELLM_SALT_KEY, and limiting the proxy's outbound traffic to known provider endpoints.