Image: Check Point Research
Organizations running the LiteLLM gateway should upgrade to version 1.83.9 or later. Flaws in version 1.77.7 could let a signed-in, low-privilege user steal secrets, take over an administrator account or run code on the gateway server.
Update LiteLLM now
Check Point Research assessed LiteLLM 1.77.7 and says the reported vulnerabilities, tracked as CVE-2026-35029 and CVE-2026-59823, are resolved in version 1.83.9.- Upgrade every LiteLLM gateway to version 1.83.9 or newer.
- Treat access from ordinary authenticated accounts as potentially dangerous until the update is installed.
- After updating, review provider credentials and other secrets stored on or accessible to the gateway, because the flaws allowed credential access and extraction.
A basic account could change critical settings
The main weakness was a missing role check on the POST /config/update administrative endpoint. A permissive route check also allowed any user with a valid web-interface session token to reach it, regardless of whether that user was an administrator.That access let an attacker alter environment variables—settings used by the running service. Researchers found this could expose any file readable by the LiteLLM process, including configuration files, credentials and other secrets.
The same route could overwrite the web interface's username and password settings. A low-privilege user could then sign in as the built-in proxy administrator and gain control of the gateway.
Configuration changes could execute code
LiteLLM supports pass-through endpoints that can load custom Python modules from Amazon S3 or Google Cloud Storage. By changing this configuration, an attacker could make the gateway download a malicious module and execute its code.This remote code execution could provide access to LiteLLM data and a foothold in the network hosting the gateway. The finding concerns the LiteLLM service and the permissions of its process; it does not automatically mean every connected PC is compromised.
Provider API keys were also at risk
A separate server-side request forgery flaw affected the “Clientside LLM Credentials” feature. Server-side request forgery, or SSRF, means an attacker can make a server send requests to destinations chosen by the attacker.Any authenticated user could redirect AI provider calls to an arbitrary endpoint, potentially exposing provider API keys or allowing probes of internal network services.
