Warning Over High-Risk Vulnerabilities in Widely Used LLM Gateway Tool

High-risk cybersecurity vulnerabilities have been uncovered in a widely deployed large language model (LLM) gateway tool used by organizations to connect their AI applications to AI software providers including OpenAI, Google and Anthropic.

With almost 100,000 downloads a month, LiteLLM is an open-source tool widely used across enterprises to aid with the building of AI applications and services.

The two vulnerabilities, tracked as CVE-2026-35029 and CVE-2026-59823, could allow any user to gain administrative access to the LLM gateway.

According to cybersecurity researchers at Check Point, this could potentially allow an attacker to perform a full system takeover, providing them with file access, the ability to steal login credentials and even the powers to remotely execute code.

The findings were detailed in a blog post published on October 13, and the vulnerabilities affect versions of LiteLLM that are older than version 1.83.9.

LLM gateways are systems that sit between an application and one or more LLM providers. Instead of calling model APIs directly, applications route requests through a gateway, which then forwards those requests to the appropriate model backend.

Exploits Allow Full System Takeover

Importantly, LLM gateways are often used to centralize management of activities such as credential management, logging and usage tracking. That means the gateways are responsible for storing API keys for every AI provider the organization uses, as well as managing user access through roles and permissions.

By combining this level of access with the CVE-2026-35029 vulnerability, an attacker could exploit a missing authorization check to modify a runtime configuration, potentially allowing full system takeover and remote code execution via malicious Python modules loaded from cloud storage.

Meanwhile, the vulnerability tracked as CVE-2026-59823 could allow an attacker to exploit server-side request forgery to redirect the gateway’s outbound requests, exposing AI provider API keys.

“In practical terms, anyone holding an account on a vulnerable LiteLLM deployment could take over the gateway and use it for malicious purposes,” said Mateo Rojas-Carulla, head of research for AI agent security at Check Point.

Check Point reported both vulnerabilities to LiteLLM through the coordinated disclosure process and LiteLLM version 1.83.9, and all later versions include the fixes to close off the vulnerabilities. Users have been urged to make sure their version of LiteLLM is up to date.

“These findings are familiar application security failures. A missing permission check allowed low-privileged users to reach administrative functions with consequences including code execution,” said Christopher Jess, senior R&D manager at Black Duck, an application security company.

“Centralizing AI access makes such gateways a particularly valuable target which should be secured accordingly. This is another example of the worrying trend of security fundamentals being treated as secondary concerns as adoption of the AI ecosystem accelerates,” he added.

How to Protect Against AI Vulnerability Exploits

In addition to updating to the latest version of LiteLLM, Check Point recommended the companies should apply the following steps to help secure their AI infrastructure:

• Review who has access to your gateway. Since any account could be used to exploit these flaws, audit user accounts and remove those that are no longer needed.
• Rotate AI provider API keys stored in LiteLLM if there is any indication the gateway was accessed by unauthorized users before patching.
• Verify permissions in practice. Confirm that users with limited roles are actually limited, because the gap between configured and enforced permissions is where flaws like CVE-2026-35029 cause the most damage.
• Include LLM gateways in security assessments by extending penetration tests and vulnerability assessments to cover AI tooling alongside web applications and cloud infrastructure.