LiteLLM Flaws Enable Privilege Escalation and OIDC Authentication Bypass

LiteLLM fixed two high-severity vulnerabilities in version 1.83.0 that could allow attackers to gain elevated access in AI gateway deployments. CVE-2026-35029 stems from missing admin authorization on the /config/update endpoint, allowing an authenticated low-privilege user to change proxy settings and environment variables. The flaw could be abused to register attacker-controlled Python handlers for remote code execution, read arbitrary server files, and overwrite UI credentials to seize privileged accounts, creating broad confidentiality, integrity, and availability risk.

The same release also addressed CVE-2026-35030, an authentication bypass affecting LiteLLM deployments that enabled JWT-based authentication. In vulnerable versions, the platform used the first 20 characters of a token as the OIDC userinfo cache key, allowing a crafted token with a matching prefix to collide with a legitimate cached session and inherit that user’s identity and permissions. The issue is not enabled by default, limiting exposure to specific configurations, but together the flaws highlight significant access-control weaknesses in LiteLLM versions prior to 1.83.0.