Check Point Discovers High-Risk Flaws in LiteLLM Gateway Tool
Researchers found authorization bypass and SSRF vulnerabilities in the popular open-source LLM gateway, resolved in version 1.83.9.
Key points
- Check Point identified two high-severity vulnerabilities in LiteLLM versions prior to 1.83.9.
- CVE-2026-35029 allows low-privileged users to modify runtime configuration and execute code.
- CVE-2026-59823 enables server-side request forgery to exfiltrate AI provider API keys.
Check Point Research disclosed two high-severity vulnerabilities in LiteLLM, a widely adopted open-source large language model gateway, on October 13. The findings, tracked as CVE-2026-35029 and CVE-2026-59823, affect versions older than 1.83.9 and have been resolved in the latest release.
The most critical issue, CVE-2026-35029, stems from a missing authorization check on the /config/update endpoint. This flaw allows any authenticated user, including those with low privileges, to modify the proxy’s runtime configuration. Attackers can leverage this access to read arbitrary files, take over administrative accounts, or achieve remote code execution by loading malicious Python modules from cloud storage.
A second vulnerability, CVE-2026-59823, involves server-side request forgery within the “Clientside LLM Credentials” feature. According to Check Point, this defect allows attackers to redirect API calls and exfiltrate sensitive provider keys. These findings highlight risks in AI infrastructure tools that manage credentials and request routing between applications and model providers.
Context and Background
LiteLLM serves as an intermediary between applications and LLM providers such as OpenAI, Google, and Anthropic. Instead of calling model APIs directly, organizations route requests through the gateway to centralize credential management, logging, and usage tracking. The project, which originated through Y Combinator, is commonly deployed as a standalone service in many AI-based applications.
Check Point conducted its security assessment against LiteLLM version 1.77.7. The review focused on the gateway component, which plays a central role in handling LLM requests. Researchers noted that while secure endpoints within LiteLLM verify the PROXY_ADMIN role, the /config/update endpoint lacked this role-based access control check, leading to the discovered bypass.
Who Is Affected
LiteLLM sees approximately 100,000 downloads per month and is used extensively by enterprises to build AI applications. Any organization running LiteLLM versions older than 1.83.9 is exposed to these risks. According to Infosecurity Magazine, the vulnerabilities could allow any user with an account on a vulnerable deployment to gain administrative access to the gateway.
Mateo Rojas-Carulla, head of research for AI agent security at Check Point, stated that anyone holding an account on a vulnerable LiteLLM deployment could take over the gateway. This access could enable full system takeover, providing attackers with file access, credential theft capabilities, and remote code execution powers.
What should you do?
Check Point reported both vulnerabilities to LiteLLM through coordinated disclosure. The vendor has released version 1.83.9, which includes fixes for both CVE-2026-35029 and CVE-2026-59823. Users are urged to update their LiteLLM installations immediately to mitigate the risk of unauthorized configuration changes and credential exfiltration.
Background: Large language models
Large language models are a specific type of neural network trained on text. Generative AI is the broader umbrella term for any system that creates new content, including images and code. Not all generative AI uses large language models, but most modern text generators do.
What to do and how to stay safe: LiteLLM
- Verify your current LiteLLM version and upgrade to 1.83.9 or later to apply the confirmed patches.
- Audit existing user accounts and permissions to ensure no low-privileged accounts have been compromised.
- Rotate all AI provider API keys stored in the gateway configuration as a precautionary measure.
- Monitor gateway logs for unauthorized configuration changes or unusual outbound requests to cloud storage.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which LiteLLM versions are affected by these vulnerabilities?
All LiteLLM versions older than 1.83.9 are affected by CVE-2026-35029 and CVE-2026-59823.
Can low-privileged users exploit these flaws?
Yes, CVE-2026-35029 allows any authenticated user, including those with low privileges, to modify runtime configuration.
Is there a fix available for these vulnerabilities?
Yes, LiteLLM version 1.83.9 and all subsequent versions include the necessary fixes.
