Check Point has disclosed two vulnerabilities in LiteLLM, an open-source AI gateway downloaded more than 90 million times per month. The issues, tracked as CVE-2026-35029 (CVSS 8.7) and CVE-2026-59823 (CVSS 5.3), affect all versions before 1.83.9 and allow low-privilege users to take over the gateway, read server files, and steal API keys stored for providers such as OpenAI, Anthropic, and Azure OpenAI.
A recent incident at an internet company illustrated the risk when an intern successfully called the GPT-4 API using a corporate key. Investigation revealed that the LiteLLM instance lacked proper authorization checks on its configuration endpoint, enabling any authenticated account to alter settings arbitrarily.
What LiteLLM Does
LiteLLM acts as a central proxy that unifies access to more than 140 AI vendors. It handles routing, load balancing, key management, usage monitoring, and cost control so developers do not need to manage individual provider APIs directly. Because it stores real API credentials for enterprise use, compromise of the gateway can lead to unauthorized consumption of AI resources and exposure of business logic derived from call patterns.
CVE-2026-35029: Unauthorized Configuration Changes
The first flaw resides in the /config/update endpoint. The code performs no role verification, so any authenticated user—including interns or accounts obtained through phishing—can modify runtime settings. Attackers can read arbitrary server files containing stored keys, redirect requests to attacker-controlled servers, hijack administrator accounts, or implant malicious code for remote code execution.
CVE-2026-59823: SSRF Vector
The second issue is a server-side request forgery vulnerability. When combined with the configuration flaw, it allows an attacker to force the gateway to reach internal databases, metadata services, or other sensitive systems. In cloud environments this often serves as the initial step toward obtaining temporary credentials and lateral movement.
Scope and Remediation
LiteLLM 1.83.9 contains fixes for both vulnerabilities. Because the component is frequently embedded inside larger AI platforms rather than deployed standalone, many organizations may be unaware of its presence. Security teams should:
- Upgrade via pip install litellm --upgrade
- Restrict access to the management interface so only users with the proxy_admin role can call configuration endpoints
- Rotate all stored API keys if unauthorized access cannot be ruled out
- Search codebases and dependency files for references to litellm
- Enable detailed logging to detect anomalous configuration changes
The disclosure underscores that core security controls remain essential even in rapidly adopted AI infrastructure.
