Check Point Research (CPR) has identified two serious security vulnerabilities in LiteLLM, an open-source AI gateway that connects applications to AI providers such as OpenAI, Google, and Anthropic. The software handles around 100 million downloads monthly and has more than 59,000 GitHub stars, according to CPR.
Researchers tested LiteLLM version 1.77.7 and found flaws that could let authenticated users with limited privileges access sensitive files, take over administrator accounts, execute arbitrary code, and steal AI provider API keys.
Missing Authorization Enables Gateway Takeover
The more serious vulnerability, CVE-2026-35029, involves a missing authorization check on the /config/update endpoint, which manages the gateway’s runtime configuration. A flaw in how user interface tokens were authorized allowed low-privilege users to modify settings reserved for administrators. By changing environment variables, an attacker could exploit the same flaw in several ways.
- File Extraction: An attacker can inject custom variables into os.environ through the environment_variables parameter to change UI_LOGO_PATH. Requesting the /get_image endpoint then returned sensitive internal files, including system secrets.
- Administrative Takeover: Changing UI_USERNAME and UI_PASSWORD environment variables overrides the proxy credentials. An attacker could then log in through the /login route to gain full PROXY_ADMIN control and take over the default account.
- Remote Code Execution (RCE): The flaw could additionally lead to remote code execution. LiteLLM supports custom pass-through endpoints that load Python modules from cloud storage. An attacker could configure an endpoint to load a malicious module from Amazon S3 or Google Cloud Storage, causing its code to execute on the gateway server.
These attack paths could give an attacker access to sensitive configuration data, provider credentials, and the system running LiteLLM, Check Point Research reported.
SSRF Flaw Exposes Provider API Keys
The second flaw, CVE-2026-59823, involves Server-Side Request Forgery (SSRF) within the system’s “Clientside LLM Credentials” feature. Check Point Research found that the /chat/completions endpoint accepts a user_config parameter that lets authenticated users provide their own routing settings without proper validation.
An attacker could use this parameter to send AI requests to a server they control instead of the intended provider. The requests could include API keys stored in the gateway’s default headers, allowing the attacker to capture credentials they should not have access to.
Fix and Additional Security Issues
Researchers also reported exposed password hashes and weak password storage practices that made the hashes easier to crack. Check Point noted that these findings were associated with GitHub Security Advisory GHSA-69×8-hrgq-fjj8.
This disclosure adds to a challenging year for LiteLLM’s security stance, coming months after a separate March 2026 supply-chain attack where threat group TeamPCP published malicious package versions (1.82.7 and 1.82.8) to PyPI.
Both vulnerabilities are fixed in LiteLLM version 1.83.9 and later. Organizations using older versions should upgrade and review access to their gateways. If unauthorized access is suspected, consider rotating affected AI provider API keys.
Experts’ Commentary:
The LiteLLM findings also highlight broader security concerns around AI infrastructure. Li Zhao, Principal Strategic Services Consultant at Black Duck, told Hackread.com that the vulnerabilities show why AI security must extend beyond models and prompts.
“These are well-understood application security issues, but when they occur in AI infrastructure, their impact can be amplified significantly,” Zhao said. “What makes these vulnerabilities particularly significant is the role that LLM gateways now play in enterprise AI environments. They often serve as centralized trust brokers between applications and AI providers, managing API credentials, request routing, policy enforcement, usage tracking, and access controls.”
Boris Cipot, Principal Security Engineer at Black Duck, also shared his comments, warning that attackers may find it easier to target the software connecting organizations to AI providers than the providers themselves.
“This also shows that attackers do not need to breach OpenAI, Anthropic or Google directly. It may be easier to target the trusted software sitting between those providers and their customers,” Cipot said. “The risk is made harder to manage because LiteLLM can be embedded in other AI platforms and internal tools, meaning some organizations may not even realize they are using it.”
