CVE-2026-35029

LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint

No known exploitation. EPSS puts it in the 90th percentile. Fixed in 1.83.0.

CVSS 3.18.8High EPSS percentile90th4.0% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix1.83.0Upgrade to this build

Published 2026-04-06Updated 2026-07-15Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

BerriAI litellmAffected: < 1.83.0Upgrade to: not statedStated by: CVE record
LitellmAffected: < 1.83.0Upgrade to: 1.83.0Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check if you are running a LiteLLM proxy server and which version it is.
If you have any user accounts below full-admin level that can log into the proxy, treat this as urgent — they can currently escalate to admin.
Upgrade LiteLLM to version 1.83.0 or later.
If you cannot upgrade immediately, apply the workaround described in the vendor's security advisory to restrict access to the /config/update endpoint.
After upgrading, review who has accounts on the proxy and rotate any admin credentials (UI_USERNAME/UI_PASSWORD) as a precaution.

pip install litellm>=1.83.0

Usually a quick update

Check it yourselfA free Nuclei and OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

Coverage timeline

2 publishers

Technical analysis published
as reported · Oct 13, 2026·Check Point Research summary
Vendor patch released
as reported · Jul 24, 2026·The Hacker News summary

Sourced from public security reporting — each date is when it was published, not when it happened. 1 further article named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to modify proxy configuration and environment variables, register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution, read arbitrary server files by setting UI_LOGO_PATH and fetching via /get_image, and take over other privileged accounts by overwriting UI_USERNAME and UI_PASSWORD environment variables. Fixed in v1.83.0.

In plain language

Written by AI from the record

A security flaw in LiteLLM (an AI proxy server) lets any logged-in user turn into a full admin and run their own code on your server, so if you run LiteLLM you should upgrade now.

Broken authorization on LiteLLM's /config/update endpoint (CWE-863/CWE-425) lets any authenticated low-privilege user rewrite proxy configuration and environment variables to register attacker-controlled pass-through handlers, achieving remote code execution, arbitrary file read, and admin account takeover.

If you're affected

Full server takeover
Admin account hijacking
Arbitrary file disclosure
AI API cost/data abuse
Operational disruption

What is it

LiteLLM is a gateway server that businesses use to route requests to AI models. Imagine a building where any employee badge — even a junior one — can open the master control panel and reprogram the whole building, including giving themselves the owner's keys. That's what this flaw allows: a regular logged-in user can rewrite server settings to run their own code or lock out the real admin.

Who is affected

This matters to you if you run a LiteLLM proxy server to manage calls to AI models, especially if multiple people or systems have accounts on it. The risk only requires that someone already has a valid login to your LiteLLM instance — no special permissions are needed to trigger the escalation.

How urgent is it

This is a severe, easy-to-exploit flaw: any authenticated user, regardless of how limited their intended access is, can escalate straight to full admin and run their own code on the server with no extra steps. There's no confirmed public exploitation yet, but the low complexity of the attack and the complete control it hands over mean you should treat this as urgent and not wait.

What to do — in detail

Confirm your LiteLLM proxy version via its admin UI or deployment manifest/container tag. Any version prior to 1.83.0 is affected. Upgrade to 1.83.0 or later, which adds proper admin-role enforcement on the /config/update endpoint. If immediate upgrade isn't possible, apply the mitigation in the vendor's GHSA-53mr-6c8q-9789 advisory (restrict or disable access to /config/update for non-admin roles via a reverse proxy or network policy) as a temporary stopgap. After upgrading, audit all existing user roles, rotate UI_USERNAME/UI_PASSWORD and any environment-variable-based secrets that could have been altered, and review logs for unexpected calls to /config/update or /get_image, or newly registered pass-through endpoint handlers. Not in CISA KEV and no confirmed in-the-wild exploitation at this time; only a detection template exists, so monitor vendor and news sources for escalation.

Technical context

CVSS 8.8 (High) — AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — reflects network-exploitable, low-complexity, low-privilege-required attack with full compromise of confidentiality, integrity, and availability. Weakness: CWE-863 (Incorrect Authorization) combined with CWE-425 (Direct Request / Forced Browsing) on the /config/update endpoint, which fails to enforce admin-role checks. Impact chain includes RCE via attacker-controlled pass-through endpoint handlers, arbitrary file read via UI_LOGO_PATH/get_image manipulation, and account takeover by overwriting UI_USERNAME/UI_PASSWORD. Not listed in CISA KEV; no confirmed exploitation. Exploit maturity is low — only a detection template exists, not a working exploit. Press attention is rising (roundup coverage, actor reference ARMORY CASTLE) but this reflects visibility, not confirmed attacks. Fixed in litellm 1.83.0; vendor workaround published at the linked GHSA advisory.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS90th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

4.0% chance of exploitation activity in the next 30 days, which ranks it in the 90th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Rising, driven by in-the-wild reports.

Lifecycle

15 events over 177 days, from the signal feeds we watch.

2026-09-30EPSS band changemoderate → low
2026-09-24EPSS band changemoderate → lowepss band change
2026-07-15Patch availableworkaround available, record updated
2026-06-30Patch availableworkaround available, record updated
2026-06-25OpenVAS check added
2026-04-27EPSS band changelow → moderate

Affected products

litellmoss-project
- litellmMixedAI / ML / llm-serving-inference
BerriAIcommercialaka litellm, berriai/litellm
- litellmSaaSAI / ML / llm-serving-inference

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable