Full Report
TL;DR; Our security assessment of LiteLLM (v1.77.7), a widely used open-source LLM gateway, uncovered multiple high-impact vulnerabilities (tracked as CVE-2026-35029, CVE-2026-59823) which have been resolved as of LiteLLM version 1.83.9. The most significant issues stemmed from a missing authorization check on the /config/update endpoint, which allowed any authenticated user (including low-privileged accounts) to modify the […] The post When LLM Gateways Go Wrong: Findings from LiteLLM appeared first on Check Point Research.
Analysis Summary
# Vulnerability: Critical Access Control Bypass and SSRF in LiteLLM Gateway
## CVE Details
- **CVE ID:** CVE-2026-35029, CVE-2026-59823
- **CVSS Score:** 9.8 (Critical) - *Estimated based on impact*
- **CWE:** CWE-285 (Improper Authorization), CWE-918 (Server-Side Request Forgery), CWE-94 (Code Injection)
## Affected Systems
- **Products:** LiteLLM (LLM Gateway)
- **Versions:** Vulnerable up to version 1.77.7
- **Configurations:** Deployments using the Proxy UI or the management API where user authentication is enabled.
## Vulnerability Description
Multiple high-impact vulnerabilities were discovered in the LiteLLM gateway:
1. **Missing Authorization on `/config/update` (CVE-2026-35029):** The endpoint designed for runtime configuration updates failed to verify if the authenticated user possessed the `PROXY_ADMIN` role. This allowed any user with a valid session (even low-privileged ones) to modify global proxy settings, environment variables, and model configurations.
2. **Remote Code Execution (RCE):** By abusing the `/config/update` vulnerability, an attacker could point the proxy to a malicious Python module hosted on cloud storage (e.g., S3/GCS). The proxy would dynamically load and execute this code.
3. **Arbitrary File Read:** Attackers could manipulate environment variables or configuration paths to read sensitive files from the local filesystem.
4. **SSRF in "Clientside LLM Credentials":** A flaw in the credential handling logic allowed attackers to redirect API calls to arbitrary internal or external endpoints, leading to the exfiltration of provider API keys.
## Exploitation
- **Status:** PoC available (documented by Check Point Research).
- **Complexity:** Low (Requires valid low-privileged credentials).
- **Attack Vector:** Network (Remote via API/UI).
## Impact
- **Confidentiality:** High (Access to API keys, model data, local system files, and database credentials).
- **Integrity:** High (Ability to modify gateway configuration, swap LLM models, and alter system logs).
- **Availability:** High (Potential to disrupt service or gain full system control via RCE).
## Remediation
### Patches
- **Update to LiteLLM version 1.83.9 or later.** These versions implement proper RBAC checks on management endpoints and sanitize inputs for the dynamic loading features.
### Workarounds
- Disable the Proxy UI if not strictly required.
- Restrict network access to the management/admin ports to trusted IP ranges only.
- Implement external WAF rules to block access to the `/config` and `/invitation` paths for non-admin users.
## Detection
- **Indicators of Compromise:**
- Unexpected `POST` requests to the `/config/update` endpoint originating from non-admin user accounts.
- Outbound connections from the LiteLLM gateway to unrecognized cloud storage buckets or external IP addresses (potential module loading or SSRF).
- Presence of unfamiliar Python modules in the proxy runtime environment.
- **Detection Methods:** Monitor LiteLLM application logs for authentication bypass attempts and audit the `config.yaml` or database-backed configurations for unauthorized changes to `model_list` or `environment_variables`.
## References
- **Vendor Advisory:** hxxps://github[.]com/BerriAI/litellm/releases
- **Check Point Research Report:** hxxps://research[.]checkpoint[.]com/2026/when-llm-gateways-go-wrong-findings-from-litellm/
- **NVD Entries:**
- hxxps://nvd[.]nist[.]gov/vuln/detail/CVE-2026-35029
- hxxps://nvd[.]nist[.]gov/vuln/detail/CVE-2026-59823