Story · 2 sources · 2 articlesfirst Oct 13, 14:30 UTCupdated Oct 15, 11:30 UTC (1d ago)

Patched LiteLLM flaws allow takeover, code execution, key theft

highVulnerabilityimportance 80CVE-2026-35029 CVE-2026-59823

What's new: First coverage.

Merged summary · grok-4.7-build · rewritten as coverage arrives

Check Point found LiteLLM flaws CVE-2026-35029 and CVE-2026-59823, fixed in 1.83.9, enabling config takeover, file read, RCE, and key theft.

Check Point Research assessed LiteLLM 1.77.7 and disclosed two high-impact flaws, CVE-2026-35029 and CVE-2026-59823, which Infosecurity Magazine said affect versions older than the 1.83.9 fix. CVE-2026-35029 is a missing authorization check on POST /config/update that lets any authenticated user, including low-privilege accounts, change runtime configuration. Check Point said that can lead to arbitrary file read, administrative takeover, and remote code execution by loading malicious Python modules from cloud storage, while Infosecurity described config changes and code execution via malicious Python modules without mentioning file read or cloud storage. CVE-2026-59823 is a server-side request forgery in the Clientside LLM Credentials feature that can redirect API or outbound calls and expose stored AI provider keys. LiteLLM, an open-source gateway with nearly 100,000 monthly downloads that proxies major model providers, fixed both issues in 1.83.9. Infosecurity said exploitation was not reported and that Check Point urged account reviews, key rotation, and permission testing; Check Point also called for strict access control and input validation.

Check Point assessed LiteLLM 1.77.7; Infosecurity said versions older than 1.83.9 are affected.
CVE-2026-35029 is a missing authorization check on POST /config/update that lets any authenticated user, including low-privilege accounts, change runtime configuration.
Reported impact includes arbitrary file read, administrative takeover, and remote code execution via malicious Python modules; Check Point specified loading from cloud storage.
CVE-2026-59823 is an SSRF in the Clientside LLM Credentials feature that can redirect requests and expose stored AI provider API keys.
Both flaws were fixed in LiteLLM 1.83.9; Infosecurity said active exploitation was not reported.
LiteLLM is an open-source gateway with nearly 100,000 monthly downloads that proxies major model providers.
Advised steps include account reviews, key rotation, permission testing, strict access control, and input validation.

VendorsLiteLLM

ProductsLiteLLM

OrganizationsCheck Point Black Duck Y Combinator

Coverage timelineoldest first · each row is one article

Oct 13, 14:30 UTC · 3d ago
Check Point Research· 76
When LLM Gateways Go Wrong: Findings from LiteLLM
Check Point found patched LiteLLM flaws enabling config takeover, file read, RCE, and key theft.
Oct 15, 11:30 UTC · 1d ago
Infosecurity Magazine· 80
Warning Over High-Risk Vulnerabilities in Widely Used LLM Gateway Tool
Check Point warns LiteLLM flaws CVE-2026-35029 and CVE-2026-59823 can give any user admin access and code execution.

Vulnerabilities in this storyAll →

CVE-2026-350298.725%
Broken Access Control in LiteLLM AI Gateway Enables Authenticated RCE
published Apr 6, 2026· LiteLLM proxy server (AI Gateway)
CVE-2026-598235.3—
Authenticated SSRF in LiteLLM Proxy via user_config
published Sep 16, 2026· BerriAI LiteLLM Proxy (AI Gateway)

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-35029	Broken Access Control in LiteLLM AI Gateway Enables Authenticated RCE CVE-2026-35029 is a broken access control flaw (CWE-863, CWE-425) in LiteLLM, an open-source proxy server (AI Gateway) for calling LLM APIs, in which the /config/update endpoint fails to enforce admin-role authorization in versions prior to 1.83.0. Any user who is already authenticated to the proxy can call this network-accessible endpoint without admin rights and modify the proxy configuration and environment variables. Through this, an attacker can achieve remote code execution by registering pass-through endpoint handlers that point to attacker-controlled Python code, read arbitrary server files by setting UI_LOGO_PATH and fetching the file via /get_image, and take over other privileged accounts by overwriting the UI_USERNAME and UI_PASSWORD environment variables; related security coverage also highlights that vulnerable LiteLLM gateways can be turned into root-level code execution and cloud credential theft. Any organization running a LiteLLM proxy older than v1.83.0 is affected, particularly deployments where non-admin users hold authenticated accounts. No public proof-of-concept or confirmed in-the-wild exploitation is known and the flaw is not in CISA KEV, but EPSS assigns a 25.1% probability of exploitation within 30 days (98th percentile), signaling elevated near-term risk. Do: Upgrade to LiteLLM v1.83.0 or later. Until patched, restrict network access to /config/update so only administrators can reach it, and limit how many non-admin accounts hold API/UI credentials on the proxy. Audit configuration and environment variables for tampering (especially UI_USERNAME, UI_PASSWORD, UI_LOGO_PATH, and registered pass-through handlers), and rotate cloud credentials stored in the gateway's environment if compromise is suspected.	8.7	25%		LiteLLM proxy server (AI Gateway) all versions prior to 1.83.0; fixed in v1.83.0	moderateon the order of thousands of self-hosted gateway deployments (estimate; no published install counts)	Apr 6, 2026
CVE-2026-59823	Authenticated SSRF in LiteLLM Proxy via user_config LiteLLM Proxy versions before 1.83.9 let an authenticated caller who already has a valid virtual key bypass request-body checks by nesting api_base inside user_config. The check is_request_body_safe blocked top-level api_base and base_url but did not inspect or reject that nested field. Because user_config builds the outbound router, the proxy then makes a server-side request to an internal or external host chosen by the caller, which can reveal endpoints the caller could not reach directly (CWE-918). Organizations running a LiteLLM AI gateway on those versions are affected. It is fixed in 1.83.9; it is not listed in CISA KEV and no public proof-of-concept is known. Do: Upgrade the LiteLLM Proxy to 1.83.9 or later. Until then, restrict who can hold virtual keys, limit the proxy's network reach to internal services, and review logs for user_config values that set api_base or similar outbound destinations.	5.3	—		BerriAI LiteLLM Proxy (AI Gateway) prior to 1.83.9	—	Sep 16, 2026

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-35029

Broken Access Control in LiteLLM AI Gateway Enables Authenticated RCE

CVE-2026-35029 is a broken access control flaw (CWE-863, CWE-425) in LiteLLM, an open-source proxy server (AI Gateway) for calling LLM APIs, in which the /config/update endpoint fails to enforce admin-role authorization in versions prior to 1.83.0. Any user who is already authenticated to the proxy can call this network-accessible endpoint without admin rights and modify the proxy configuration and environment variables. Through this, an attacker can achieve remote code execution by registering pass-through endpoint handlers that point to attacker-controlled Python code, read arbitrary server files by setting UI_LOGO_PATH and fetching the file via /get_image, and take over other privileged accounts by overwriting the UI_USERNAME and UI_PASSWORD environment variables; related security coverage also highlights that vulnerable LiteLLM gateways can be turned into root-level code execution and cloud credential theft. Any organization running a LiteLLM proxy older than v1.83.0 is affected, particularly deployments where non-admin users hold authenticated accounts. No public proof-of-concept or confirmed in-the-wild exploitation is known and the flaw is not in CISA KEV, but EPSS assigns a 25.1% probability of exploitation within 30 days (98th percentile), signaling elevated near-term risk.

Do: Upgrade to LiteLLM v1.83.0 or later. Until patched, restrict network access to /config/update so only administrators can reach it, and limit how many non-admin accounts hold API/UI credentials on the proxy. Audit configuration and environment variables for tampering (especially UI_USERNAME, UI_PASSWORD, UI_LOGO_PATH, and registered pass-through handlers), and rotate cloud credentials stored in the gateway's environment if compromise is suspected.

8.7

25%

LiteLLM proxy server (AI Gateway) all versions prior to 1.83.0; fixed in v1.83.0

moderateon the order of thousands of self-hosted gateway deployments (estimate; no published install counts)

Apr 6, 2026

CVE-2026-59823

Authenticated SSRF in LiteLLM Proxy via user_config

LiteLLM Proxy versions before 1.83.9 let an authenticated caller who already has a valid virtual key bypass request-body checks by nesting api_base inside user_config. The check is_request_body_safe blocked top-level api_base and base_url but did not inspect or reject that nested field. Because user_config builds the outbound router, the proxy then makes a server-side request to an internal or external host chosen by the caller, which can reveal endpoints the caller could not reach directly (CWE-918). Organizations running a LiteLLM AI gateway on those versions are affected. It is fixed in 1.83.9; it is not listed in CISA KEV and no public proof-of-concept is known.

Do: Upgrade the LiteLLM Proxy to 1.83.9 or later. Until then, restrict who can hold virtual keys, limit the proxy's network reach to internal services, and review logs for user_config values that set api_base or similar outbound destinations.

5.3

—

BerriAI LiteLLM Proxy (AI Gateway) prior to 1.83.9

—

Sep 16, 2026