Significant Vulnerabilities Discovered in LiteLLM: Major Security Implications for AI Infrastructure
Check Point Research has recently unveiled two critical vulnerabilities in LiteLLM, the open-source software that acts as a gateway between enterprise applications and leading AI providers such as OpenAI, Anthropic, and Google. These vulnerabilities aim to highlight a concerning security lapse; they could potentially allow unauthorized users with minimal privileges to gain full control over the gateway, expose sensitive files, execute arbitrary code, and misappropriate API keys that organizations use to interface with their AI service providers.
LiteLLM has garnered substantial attention in the tech community, being downloaded approximately 97 million times every month and boasting more than 59,000 stars on GitHub. The two vulnerabilities, identified as CVE-2026-35029 and CVE-2026-59823, have been addressed in the latest version 1.83.9 of the platform.
Flaw Analysis: Three Attack Paths on One Endpoint
The first and most urgent flaw is CVE-2026-35029, characterized by a missing authorization check within LiteLLM’s /config/update endpoint, which controls the proxy’s runtime configuration. Unlike other administrative endpoints, this particular one has failed to verify whether the individual making the request holds the proper PROXY_ADMIN role.
Additionally, users who log in through the LiteLLM dashboard receive a session token associated with a specific “litellm-dashboard” team. These tokens are validated against a more permissive list of approved UI routes, which, due to lax security controls, encompasses the /config endpoint. Because the authorization check is based on simple prefix matching, any logged-in user can access /config/update, regardless of their designated role.
In testing with LiteLLM version 1.77.7, researchers demonstrated that this vulnerability could be exploited in multiple harmful ways:
- Reading arbitrary files: Attackers can inject an environment variable to redirect the dashboard logo path to sensitive files such as
/etc/passwd. - Taking over the built-in admin account: By overwriting the
UI_USERNAMEandUI_PASSWORDvariables, attackers can log in with credentials of their choosing. - Executing remote code: This is achievable by registering a "pass-through endpoint" that downloads a malicious Python module from an attacker-controlled S3 or GCS bucket, which LiteLLM would then execute.
API Key Theft without Direct Access
The second vulnerability, CVE-2026-59823, involves a server-side request forgery (SSRF) issue related to the "Clientside LLM Credentials" functionality. An authenticated user can manipulate the user_config parameter in the /chat/completions endpoint to direct requests to their own server. Consequently, these requests, which include the provider API keys, are sent to the attacker instead of the intended AI provider.
Check Point emphasizes that this exploitation route effectively bypasses existing restrictions that LiteLLM had put in place for api_base and api_key parameters submitted by the client. Furthermore, the investigation uncovered that password hashes were accessible to users with minimal privileges and that the hashes were stored without salting, relying solely on a single hash iteration. These concerns echo a previously known advisory, GHSA-69×8-hrgq-fjj8.
Bridging Knowledge Gaps in AI Vulnerabilities
Check Point asserts that these vulnerabilities are not new classifications within the landscape of AI security risks. Missing authorization checks, SSRF, and unsafe dynamic module loading are well-documented issues. However, their significance is enhanced by the fact that they exist within an LLM gateway, which centrally manages provider keys, user permissions, and the routing of prompts and responses—making it a critical point of vulnerability for any organization utilizing AI technology. Given that LiteLLM is integrated into several AI platforms and internal tools, some organizations may be deploying it without even being aware of this.
Mateo Rojas-Carulla, Head of Research for AI Agent Security at Check Point Software Technologies, commented, “The industry’s focus has largely been on securing AI models, but this research highlights an equally important reality: AI infrastructure is becoming a new critical layer of enterprise security. As organizations increasingly rely on gateways like LiteLLM to connect applications, users, and AI services, these platforms become attractive targets because they sit at the center of trust.”
Rojas-Carulla further noted the immediate need for LiteLLM users to prioritize patch management and access control reviews, while emphasizing a broader lesson that applies across the sector. He stated, “Attackers will naturally target the layer that gives them the greatest access with the least resistance.”
Recommendations for Enhanced Security Posture
To mitigate the fallout from these vulnerabilities, Check Point recommends several practical steps for organizations utilizing LiteLLM:
- Immediate Upgrade: Organizations should move to LiteLLM version 1.83.9 or later across all deployments, including any instances embedded in other tools.
- User Account Audits: Conduct audits of gateway user accounts and eliminate any unnecessary accounts.
- API Key Rotation: Rotate AI provider API keys if there are indications of unauthorized access prior to applying patches.
- Role Enforcement Verification: Test that limited roles are enforced in practice, rather than merely on paper.
- Regular Security Assessments: Include LLM gateways in the scope of regular security assessments.
These vulnerabilities were formally reported to LiteLLM’s maintainers through a coordinated disclosure process that commenced in October 2025.
For a complete technical write-up, readers can access the detailed report by Check Point Research here.
The implications of these vulnerabilities extend far beyond the immediate risks, raising broader questions about the security of AI infrastructure in enterprise settings.