When LLM Gateways Go Wrong: Findings from LiteLLM
PoC publicLiteLLMOur summary
Check Point Research examined LiteLLM, a popular open-source gateway for routing requests to LLM providers, and found serious flaws in version 1.77.7, now fixed in 1.83.9. The core issue, tracked as CVE-2026-35029, was a missing authorization check on the /config/update endpoint, letting any logged-in user—even one with minimal privileges—rewrite the proxy's live configuration. From there, attackers could inject environment variables to read arbitrary files, overwrite admin login credentials to seize full control of the gateway, or register a malicious Python module from cloud storage to achieve remote code execution. A second flaw, CVE-2026-59823, resided in the "Clientside LLM Credentials" feature and let attackers abuse the user_config parameter to redirect outgoing API calls via SSRF, capturing the provider's real API keys on an attacker-run server. Researchers also flagged weakly hashed, unsalted passwords and exposed password hashes as additional risks, underscoring that even fast-moving AI infrastructure projects still need solid access-control and input-validation fundamentals.
Below is the opening; the full story is at Check Point Research.
From Check Point Research
TL;DR;
Our security assessment of LiteLLM (v1.77.7), a widely used open-source LLM gateway, uncovered multiple high-impact vulnerabilities (tracked as CVE-2026-35029, CVE-2026-59823) which have been resolved as of LiteLLM version 1.83.9.
The most significant issues stemmed from a missing authorization check on the /config/update endpoint, which allowed any authenticated user (including low-privileged accounts) to modify the proxy’s runtime configuration. This single flaw enabled arbitrary file read, administrative account takeover, and remote code execution via malicious Python modules loaded from cloud storage. A separate SSRF vulnerability in the “Clientside LLM Credentials” feature allowed attackers to redirect API calls and exfiltrate provider keys. These findings highlight that as AI infrastructure tools rapidly evolve, foundational security practices like proper access control and input validation remain essential.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.