{"record":{"id":"bae942b4ced10e6e","repo":"BerriAI/litellm","slug":"oidc-file-path-is-outside-the-allowed-credential-d","errorCode":null,"errorMessage":"oidc/file path is outside the allowed credential directories. Set LITELLM_OIDC_ALLOWED_CREDENTIAL_DIRS to extend the allowlist.","messagePattern":"oidc/file path is outside the allowed credential directories\\. Set LITELLM_OIDC_ALLOWED_CREDENTIAL_DIRS to extend the allowlist\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/secret_managers/main.py","lineNumber":90,"sourceCode":"    Resolve ``requested_path`` and verify it falls within one of the allowed\n    credential directories. Raises ``ValueError`` otherwise.\n    \"\"\"\n    if not os.path.isabs(requested_path):\n        raise ValueError(\n            \"oidc/file path must be absolute. Use the format \"\n            \"'oidc/file//var/run/secrets/<name>' (note the leading slash \"\n            \"after 'oidc/file/').\"\n        )\n    resolved: Final = os.path.realpath(requested_path)\n    for allowed in _get_oidc_allowed_credential_dirs():\n        try:\n            if os.path.commonpath([resolved, allowed]) == allowed:\n                return resolved\n        except ValueError:\n            # commonpath raises when paths are on different drives (Windows);\n            # treat as not-matching and continue.\n            continue\n    raise ValueError(\n        \"oidc/file path is outside the allowed credential directories. \"\n        \"Set LITELLM_OIDC_ALLOWED_CREDENTIAL_DIRS to extend the allowlist.\"\n    )\n\n\ndef _get_oidc_http_handler(timeout: httpx.Timeout | None = None) -> HTTPHandler:\n    \"\"\"\n    Factory function to create HTTPHandler for OIDC requests.\n    This function can be mocked in tests.\n\n    Args:\n        timeout: Optional timeout for HTTP requests. Defaults to 600.0 seconds with 5.0 connect timeout.\n\n    Returns:\n        HTTPHandler instance configured for OIDC requests.\n    \"\"\"\n    if timeout is None:\n        timeout = httpx.Timeout(timeout=600.0, connect=5.0)","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/secret_managers/main.py#L72-L108","documentation":"Security allowlist check in _resolve_oidc_file_path: the realpath of the requested credential file does not fall under any directory in _get_oidc_allowed_credential_dirs() (defaults or LITELLM_OIDC_ALLOWED_CREDENTIAL_DIRS override). Guards against path traversal outside sanctioned credential dirs.","triggerScenarios":"Thrown at litellm/secret_managers/main.py:90 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Point the oidc/file path at a file inside an allowed directory.","Set LITELLM_OIDC_ALLOWED_CREDENTIAL_DIRS to include the directory holding your token file."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}