LiteLLM Flaws Enable Gateway Takeover, Remote Code Execution and API-Key Theft

Check Point Research disclosed two high-risk vulnerabilities in LiteLLM, an open-source gateway connecting applications to AI providers. CVE-2026-35029 allowed low-privileged authenticated users, including read-only users with UI session tokens, to modify runtime configuration through /config/update, enabling arbitrary file reads, administrative account takeover and remote code execution. CVE-2026-59823 allowed authenticated users to supply unchecked user_config settings that redirected gateway requests to attacker-controlled endpoints, potentially exposing AI provider API keys and enabling internal network probing through server-side request forgery.

Researchers tested LiteLLM version 1.77.7, demonstrated exploitation in a controlled environment and coordinated disclosure with maintainers; both vulnerabilities are fixed in 1.83.9 and later. The assessment also identified exposure of other users’ password hashes and weak, unsalted password storage, reported as duplicate findings under an existing advisory. The reports do not describe exploitation in the wild. Organizations should upgrade affected deployments, audit gateway accounts and permissions, and rotate stored provider credentials if unauthorized access is suspected.