LiteLLM Authorization Flaw Enables Secret Theft and Admin Takeover; Probing Follows Disclosure

A missing authorization check in LiteLLM’s /config/update endpoint, tracked as CVE-2026-35029, allows read-only accounts to change administrator-only settings, enabling arbitrary file reads, secret exfiltration, and administrator account takeover. Zenity Labs reproduced the attack chain on LiteLLM 1.74.0 and identified 1.83.0 as the fixed release, while separately noting that 1.81.0 rejected the authorization bypass. The flaw affects configuration management in the LLM proxy, which also supports configurable pass-through endpoints.

Zenity’s honeypots recorded approximately 3,900 requests from 73 IP addresses targeting LiteLLM administrative APIs between February and June 2026, including roughly 1,000 requests to /config/update. Configuration-update probing began on April 7, one day after disclosure; specific file-read payloads appeared May 5–12. However, traffic overwhelmingly used missing or default credentials rather than low-privilege keys, so these observations do not establish successful exploitation of the read-only authorization bypass. Operators should upgrade to the identified fixed release or later, restrict administrative API access, replace default credentials, review configured pass-through exposure, and rotate potentially exposed secrets.