Loading vulnerability…
CVE-2026-35029 is an incorrect authorization vulnerability in LiteLLM, an AI gateway and proxy for LLM APIs, affecting versions prior to 1.83.0. The flaw exists because the /config/update endpoint does not enforce administrator-role authorization in the configuration update logic, allowing an already authenticated low-privileged user to invoke functionality intended for administrators. By abusing this endpoint, an attacker can modify proxy configuration and environment variables, including registering custom pass-through endpoint handlers that reference attacker-controlled Python code. The vulnerability also enables arbitrary file disclosure by changing the image path configuration used by the image retrieval functionality, and can be used to overwrite UI credential-related environment variables to seize control of more privileged accounts.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository is a standalone Python PoC for CVE-2026-35029, a broken access control issue in LiteLLM < 1.83.0 where authenticated non-admin users can call /config/update without the required proxy_admin role. The repo contains 11 files: documentation (README.md, docs/advisory.md, screenshots/README.md), environment orchestration (docker-compose.yml, litellm_config.yaml, requirements.txt), an attacker exfiltration service (exfil-server/Dockerfile and exfil-server/server.py), and exploit logic (exploit/exploit.py and exploit/payload.py). The main exploit flow in exploit/exploit.py uses requests to: verify target reachability, POST malicious JSON to /config/update, register pass-through endpoints, trigger those endpoints, and then fetch attacker-side logs from /logs. payload.py builds three malicious config payloads: one for environment variable exfiltration by mapping headers like X-Exfil-*-VAR to os.environ/VAR, one for file-read style abuse using LANGFUSE-related headers, and one for overwriting UI credentials. The included exfiltration server is a simple Python HTTP server that listens on port 9999, logs all inbound headers/body, exposes /health and /logs, and base64-decodes selected header values for easier inspection. docker-compose.yml creates a reproducible lab with PostgreSQL, a vulnerable LiteLLM image pinned by digest on port 4000, an optional fixed LiteLLM on port 4001, and the attacker exfiltration server on port 9999. The exploit’s primary demonstrated capability is unauthorized configuration modification leading to secret exfiltration (e.g., LITELLM_MASTER_KEY, DATABASE_URL, AWS_SECRET_ACCESS_KEY, OPENAI_API_KEY). The repository also documents additional impact including arbitrary file read, admin credential overwrite, and possible RCE through attacker-controlled pass-through handlers. Overall, this is a real operational PoC rather than a detector: it actively changes target configuration and exfiltrates data to attacker infrastructure.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as another nuclei template example using the correct interactsh_request extractor part; no vulnerability details are provided in this content.
A previously disclosed AI-infrastructure vulnerability mentioned only as background in connection with attacks on exposed AI infrastructure.
Unknown
An improper authorization vulnerability in LiteLLM's /config/update endpoint that allows an authenticated non-admin user to modify configuration and environment variables, leading to remote code execution, arbitrary file read, and privileged account takeover.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.