An unauthenticated request to any LLM route on a LiteLLM proxy running with an Enterprise license could make the proxy read a local file and send its contents to a URL chosen by the attacker. Reading a file like /proc/self/environ exposes LITELLM_MASTER_KEY and provider API keys, which gives the attacker full admin access to the proxy. In some configurations, this allows the attacker to then execute arbitrary python code as root.

Open source deployments without a license are not affected, because the relevant codepaths only load when an Enterprise license is active. As defense in depth, we also recommend loading the master key from a secret manager instead of the process environment, setting a separate LITELLM_SALT_KEY, and limiting the proxy's outbound traffic to known provider endpoints.