{"record":{"id":"bf7c0259b001fffb","repo":"BerriAI/litellm","slug":"oidc-file-path-must-be-absolute-use-the-format-o","errorCode":null,"errorMessage":"oidc/file path must be absolute. Use the format 'oidc/file//var/run/secrets/<name>' (note the leading slash after 'oidc/file/').","messagePattern":"oidc/file path must be absolute\\. Use the format 'oidc/file//var/run/secrets/<name>' \\(note the leading slash after 'oidc/file/'\\)\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/secret_managers/main.py","lineNumber":76,"sourceCode":"    override via the ``LITELLM_OIDC_ALLOWED_CREDENTIAL_DIRS`` environment\n    variable (comma-separated list of absolute paths).\n    \"\"\"\n    override: Final = os.getenv(\"LITELLM_OIDC_ALLOWED_CREDENTIAL_DIRS\")\n    raw_dirs: Final = (\n        [d.strip() for d in override.split(\",\") if d.strip()]\n        if override\n        else list(_DEFAULT_OIDC_ALLOWED_CREDENTIAL_DIRS)\n    )\n    return [os.path.realpath(d) for d in raw_dirs]\n\n\ndef _resolve_oidc_file_path(requested_path: str) -> str:\n    \"\"\"\n    Resolve ``requested_path`` and verify it falls within one of the allowed\n    credential directories. Raises ``ValueError`` otherwise.\n    \"\"\"\n    if not os.path.isabs(requested_path):\n        raise ValueError(\n            \"oidc/file path must be absolute. Use the format \"\n            \"'oidc/file//var/run/secrets/<name>' (note the leading slash \"\n            \"after 'oidc/file/').\"\n        )\n    resolved: Final = os.path.realpath(requested_path)\n    for allowed in _get_oidc_allowed_credential_dirs():\n        try:\n            if os.path.commonpath([resolved, allowed]) == allowed:\n                return resolved\n        except ValueError:\n            # commonpath raises when paths are on different drives (Windows);\n            # treat as not-matching and continue.\n            continue\n    raise ValueError(\n        \"oidc/file path is outside the allowed credential directories. \"\n        \"Set LITELLM_OIDC_ALLOWED_CREDENTIAL_DIRS to extend the allowlist.\"\n    )\n","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/secret_managers/main.py#L58-L94","documentation":"Path validation in _resolve_oidc_file_path: the requested oidc/file path is relative. The loader requires an absolute path (with the double slash after 'oidc/file/') so it can safely resolve and allowlist-check the credential file.","triggerScenarios":"Thrown at litellm/secret_managers/main.py:76 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use an absolute path after the scheme: 'oidc/file//var/run/secrets/token' (double slash before the absolute path)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}