Critical Vulnerabilities in LiteLLM Gateway Expose Sensitive Data and Enable RCE
Check Point Research has identified severe security flaws in the popular open-source LiteLLM gateway, including an access control bypass that could lead to remote code execution and data exfiltration.
Check Point Research has detailed multiple high-impact vulnerabilities discovered in LiteLLM, a widely adopted open-source gateway for interacting with various Large Language Models (LLMs). The findings, affecting version 1.77.7, include critical issues such as an access control bypass on the /config/update endpoint and a Server-Side Request Forgery (SSRF) flaw. These vulnerabilities, now patched in version 1.83.9, could allow authenticated users to read arbitrary files, take over accounts, and execute remote code, while the SSRF vulnerability could lead to the exfiltration of provider API keys.
The most significant vulnerability, tracked as CVE-2026-35029, stems from a missing authorization check on the /config/update endpoint. This endpoint is designed to allow runtime modifications to the proxy's configuration, including environment variables and model lists. However, due to the lack of proper role-based access control (RBAC), any authenticated user, even those with low-privileged accounts, could exploit this flaw. The research highlights that while other administrative endpoints in LiteLLM enforce strict role checks (e.g., requiring the PROXY_ADMIN role), the /config/update function failed to implement similar safeguards, relying only on a generic authentication dependency.
This access control bypass has severe implications. Attackers could leverage it to modify the proxy's runtime configuration, enabling them to read sensitive files from the server. Furthermore, by manipulating Python module loading paths within the configuration, attackers could potentially achieve remote code execution (RCE) by loading malicious modules stored in cloud storage. This capability poses a significant risk, allowing for complete compromise of systems running the vulnerable LiteLLM gateway.
Adding to the severity, a separate SSRF vulnerability (CVE-2026-59823) was found within LiteLLM's "Clientside LLM Credentials" feature. This flaw allows an attacker to manipulate API calls made by the gateway. By exploiting this, an attacker could redirect requests to arbitrary external or internal resources, potentially leading to the exfiltration of sensitive provider keys and other confidential information. This type of vulnerability is particularly dangerous in environments where the gateway manages multiple API credentials.
The researchers also detailed how the vulnerabilities could be chained. A key aspect of the exploit involves the way LiteLLM handles authentication tokens. When a user logs into the LiteLLM UI, a temporary API key is generated and associated with a special litellm-dashboard team. During the authorization process, this token is classified as a "UI" token. The /config/update endpoint, while lacking function-level authorization, does not adequately restrict actions based on this token classification, allowing authenticated UI users to perform administrative functions.
LiteLLM gateways play a crucial role in modern AI infrastructure, acting as intermediaries between applications and LLM providers. They often handle sensitive data, including API keys and user configurations. The widespread adoption of LiteLLM, originating from Y Combinator and used across the LLM ecosystem, underscores the importance of securing these foundational components. The vulnerabilities highlight a common pitfall in rapidly evolving software: the oversight of fundamental security practices like robust access control and input validation.
Check Point Research has provided clear guidance for users, urging them to update to LiteLLM version 1.83.9 or later, which addresses these critical security issues. The findings serve as a stark reminder that as AI technologies advance, the security of the underlying infrastructure tools must keep pace. Neglecting basic security principles in these gateways can open the door to significant data breaches and system compromises.
This incident underscores the broader trend of vulnerabilities emerging in the AI tooling ecosystem. As organizations increasingly rely on LLMs and related infrastructure, a proactive security posture, including regular audits and prompt patching, is essential to mitigate risks associated with credential exposure, unauthorized access, and remote code execution.