Key points
- Versions before 1.83.9 are affected by CVE-2026-35029 and CVE-2026-59823.
- A missing auth check on /config/update allows arbitrary file read and RCE.
- A server-side request forgery flaw can expose provider API keys.
Check Point Research published findings on two high-risk vulnerabilities in the LiteLLM gateway. The issues affect versions prior to 1.83.9 and have been resolved in that release.
What happened
Check Point Research assessed LiteLLM version 1.77.7 and identified multiple high-impact defects. The primary issue, CVE-2026-35029, involves a missing authorization check on the /config/update endpoint. This flaw allows any authenticated user, including those with low privileges, to modify runtime configuration. Attackers can exploit this to read arbitrary files, take over administrative accounts, or execute remote code via malicious Python modules loaded from cloud storage.
A second vulnerability, CVE-2026-59823, exists in the Clientside LLM Credentials feature. According to Check Point, this server-side request forgery flaw allows attackers to redirect API calls. This redirection can lead to the exfiltration of provider keys. The researcher noted that these findings highlight risks in rapidly evolving AI infrastructure tools where foundational security practices like access control are sometimes overlooked.
Why it matters
LiteLLM is an open-source tool widely used by enterprises to connect AI applications to providers such as OpenAI, Google and Anthropic. The tool sees almost 100,000 downloads a month, indicating broad adoption. Because gateways centralise credential management and request routing, compromising them provides attackers with significant leverage. Mateo Rojas-Carulla of Check Point stated that anyone holding an account on a vulnerable deployment could take over the gateway. This access enables full system takeover, including the ability to steal login credentials and execute code remotely.
What happens next
LiteLLM version 1.83.9 includes fixes for both CVE-2026-35029 and CVE-2026-59823. Users are urged to update to this version or later. The vulnerabilities affect all versions older than 1.83.9. Check Point reported the issues through coordinated disclosure. The fixes close the missing authorization check and the server-side request forgery vector. Organisations should verify their current version and apply the update promptly.
Patch priority
Security operations teams should prioritise updating externally accessible LiteLLM gateway instances first. Systems handling production traffic or sensitive credentials require immediate attention. Before deploying the update, validate the patch in a staging environment to ensure compatibility with existing configurations. Roll out the fix in waves, monitoring for errors after each batch. If immediate patching is not possible, restrict access to the /config/update endpoint to trusted networks only. Review user roles to ensure only necessary accounts have authentication tokens.
Background: Remote code execution vulnerabilities
Remote code execution often occurs because developers trust user input without validation, fail to restrict file permissions, or neglect to update dependencies. Fix these errors by enforcing strict input sanitisation, applying least-privilege principles, and integrating automated security checks into your secure software development lifecycle to prevent arbitrary command execution.
Read the full guide: Seven Configuration Mistakes That Allow Remote Code Execution
What to do and how to stay safe: LiteLLM
- Inventory all LiteLLM deployments and identify those running versions older than 1.83.9.
- Restrict network access to the gateway’s administrative endpoints to trusted internal IP ranges.
- Monitor logs for unusual configuration changes or outbound requests to unexpected domains.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which LiteLLM versions are affected by these vulnerabilities?
All versions prior to 1.83.9 are affected by CVE-2026-35029 and CVE-2026-59823.
Is there a fix available for these flaws?
Yes, LiteLLM version 1.83.9 and later include patches for both vulnerabilities.
What can an attacker do with these flaws?
Attackers can gain administrative access, execute remote code, and steal provider API keys.
