Broken Access Control in LiteLLM AI Gateway Enables Authenticated RCE
CVSS 4.0
8.7high
EPSS
25%p98
Published
()
Modified
AI analysis
CVE-2026-35029 is a broken access control flaw (CWE-863, CWE-425) in LiteLLM, an open-source proxy server (AI Gateway) for calling LLM APIs, in which the /config/update endpoint fails to enforce admin-role authorization in versions prior to 1.83.0. Any user who is already authenticated to the proxy can call this network-accessible endpoint without admin rights and modify the proxy configuration and environment variables. Through this, an attacker can achieve remote code execution by registering pass-through endpoint handlers that point to attacker-controlled Python code, read arbitrary server files by setting UI_LOGO_PATH and fetching the file via /get_image, and take over other privileged accounts by overwriting the UI_USERNAME and UI_PASSWORD environment variables; related security coverage also highlights that vulnerable LiteLLM gateways can be turned into root-level code execution and cloud credential theft. Any organization running a LiteLLM proxy older than v1.83.0 is affected, particularly deployments where non-admin users hold authenticated accounts. No public proof-of-concept or confirmed in-the-wild exploitation is known and the flaw is not in CISA KEV, but EPSS assigns a 25.1% probability of exploitation within 30 days (98th percentile), signaling elevated near-term risk.
What to do: Upgrade to LiteLLM v1.83.0 or later. Until patched, restrict network access to /config/update so only administrators can reach it, and limit how many non-admin accounts hold API/UI credentials on the proxy. Audit configuration and environment variables for tampering (especially UI_USERNAME, UI_PASSWORD, UI_LOGO_PATH, and registered pass-through handlers), and rotate cloud credentials stored in the gateway's environment if compromise is suspected.
Affected
LiteLLM proxy server (AI Gateway)
all versions prior to 1.83.0; fixed in v1.83.0
Estimated exposure
moderateon the order of thousands of self-hosted gateway deployments (estimate; no published install counts) — No install telemetry exists for this open-source project, so the estimate reflects LiteLLM's broad adoption as a self-hosted enterprise LLM gateway, of which only a subset are internet-exposed or issue accounts to non-admin users.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to modify proxy configuration and environment variables, register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution, read arbitrary server files by setting UI_LOGO_PATH and fetching via /get_image, and take over other privileged accounts by overwriting UI_USERNAME and UI_PASSWORD environment variables. Fixed in v1.83.0.
Wiz found multiple LiteLLM AI gateway flaws, including a CVE-2026-59822 MCP auth bypass added to CISA KEV, enabling root code execution and cloud credential theft.
An internet scan of 3,074 exposed LiteLLM instances found 294 (9.6%) accepting the default sk-1234 master key and 191 (6.2%) requiring no authentication. CVE-2026-59822 lets a single-character Bearer token establish a valid MCP session via an OAuth2 fallback in versions before 1.84.0; the flaw is in CISA's Known Exploited Vulnerabilities catalog. CVE-2026-59821 allows Python code execution as root in the gateway container via unsanitized Custom Code Guardrails registration before 1.82.0-stable, and CVE-2026-35029 permits config changes leading to RCE and admin takeover. Admin access plus pass-through endpoints can reach cloud metadata services to steal IAM credentials.
Wiz disclosed LiteLLM flaws including CVE-2026-59822 MCP auth bypass, now in CISA KEV, enabling root RCE and AWS credential theft from exposed gateways.
Wiz researchers disclosed weaknesses in the open-source LiteLLM AI gateway: CVE-2026-59821 allows authenticated administrators to execute code as root via the Custom Code Guardrails feature, while CVE-2026-59822 is an MCP authentication bypass where a meaningless Bearer token establishes a valid session. The MCP bypass was observed in the wild through Wiz honeypots and added to CISA's Known Exploited Vulnerabilities catalog on September 2. A scan of 3,074 internet-facing instances found 294 (9.6%) accepting the default master key sk-1234 or lacking authentication. Fixes shipped in LiteLLM 1.82.0 (guardrail hardening) and 1.84.0 (MCP bypass); exposed instances can leak provider API keys and temporary AWS IAM credentials via the pass-through feature and metadata service, with a related config-check issue tracked as CVE-2026-35029.