--- title: LiteLLM flaws let low-privileged users hijack AI gateway... description: Check Point Research disclosed two high-risk vulnerabilities in LiteLLM, the widely used open-source AI gateway downloaded roughly 97 million times a month.... canonical: https://daily.dev/posts/litellm-flaws-let-low-privileged-users-hijack-ai-gateway-and-steal-provider-keys-z1eue9ebf twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: LiteLLM flaws let low-privileged users hijack AI gateway and steal provider keys | daily.dev og:description: Check Point Research disclosed two high-risk vulnerabilities in LiteLLM, the widely used open-source AI gateway downloaded roughly 97 million times a month.... og:url: https://daily.dev/posts/litellm-flaws-let-low-privileged-users-hijack-ai-gateway-and-steal-provider-keys-z1eue9ebf og:image: https://api.daily.dev/og/posts/Z1EUe9Ebf.png og:image:alt: LiteLLM flaws let low-privileged users hijack AI gateway and steal provider keys og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # LiteLLM flaws let low-privileged users hijack AI gateway and steal provider keys **[IT Security Guru](https://daily.dev/sources/itsecurityguru)** · 4 min read · 0 upvotes · 0 comments ## Summary Check Point Research disclosed two high-risk vulnerabilities in LiteLLM, the widely used open-source AI gateway downloaded roughly 97 million times a month. CVE-2026-35029 is a missing authorization check on the /config/update endpoint that let any logged-in user read arbitrary files, hijack the admin account, or achieve remote code execution via malicious pass-through endpoints. CVE-2026-59823 is an SSRF flaw in the Clientside LLM Credentials feature that let authenticated users redirect provider API keys to attacker-controlled servers. Both are fixed in version 1.83.9. Researchers also found unsalted, single-iteration password hashes exposed to low-privileged users. Check Point urges immediate patching, access control audits, and key rotation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-35029 in LiteLLM and what can an attacker do with it? CVE-2026-35029 is a missing authorization check on LiteLLM's /config/update endpoint that allows any logged-in user, regardless of role, to modify runtime configuration. Because dashboard session tokens are checked against a prefix-matched route list including /config, attackers could read arbitrary files like /etc/passwd, overwrite UI_USERNAME and UI_PASSWORD to hijack the admin account, or register a malicious pass-through endpoint to achieve remote code execution. _daily.dev surfaces vulnerability writeups like this one for teams patching self-hosted AI gateways._ ### What version of LiteLLM fixes CVE-2026-35029 and CVE-2026-59823? Both vulnerabilities are fixed in LiteLLM version 1.83.9. The flaws were tested against version 1.77.7 and reported through coordinated disclosure starting in October 2025. Organizations should upgrade every deployment, including instances embedded inside other AI platforms and internal tools, since LiteLLM is often bundled without teams realizing it. _Developers tracking which dependency version closes a known CVE can follow releases like this on daily.dev._ ### How does the LiteLLM SSRF vulnerability CVE-2026-59823 let attackers steal AI provider API keys? By passing a user_config parameter to the /chat/completions endpoint, an authenticated user can create a router pointing at a server they control. LiteLLM then sends requests, along with the attached provider API keys for OpenAI, Anthropic, or Google, to that attacker-controlled server instead of the real provider. This code path bypassed existing restrictions on client-supplied api_base and api_key parameters. _Teams securing AI gateway credentials can keep up with disclosures like this via daily.dev._ ## Similar posts on daily.dev - [When LLM Gateways Go Wrong: Findings from LiteLLM](https://daily.dev/posts/when-llm-gateways-go-wrong-findings-from-litellm-cg5i3uzub) · Check Point Research · 0 upvotes · 0 comments - [LiteLLM Vulnerability Chain: What Security Teams Running AI Gateways Need to Do Now](https://daily.dev/posts/litellm-vulnerability-chain-what-security-teams-running-ai-gateways-need-to-do-now-2dh1t9pl9) · Latest Hacking News · 0 upvotes · 0 comments - [Hackers are exploiting a critical LiteLLM pre-auth SQLi flaw](https://daily.dev/posts/hackers-are-exploiting-a-critical-litellm-pre-auth-sqli-flaw-zfoa4stcb) · BleepingComputer · 0 upvotes · 0 comments - [What the LiteLLM Breach Teaches Us About Securing LLM Gateways](https://daily.dev/posts/what-the-litellm-breach-teaches-us-about-securing-llm-gateways-ysbbrmwzu) · Medium · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#litellm](https://daily.dev/tags/litellm) [View this post on daily.dev](https://daily.dev/posts/litellm-flaws-let-low-privileged-users-hijack-ai-gateway-and-steal-provider-keys-z1eue9ebf) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"LiteLLM flaws let low-privileged users hijack AI gateway and steal provider keys","url":"https://daily.dev/posts/litellm-flaws-let-low-privileged-users-hijack-ai-gateway-and-steal-provider-keys-z1eue9ebf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/litellm-flaws-let-low-privileged-users-hijack-ai-gateway-and-steal-provider-keys-z1eue9ebf"},"datePublished":"2026-10-13T18:20:18.532Z","dateModified":"2026-10-13T18:34:28.277Z","description":"Check Point Research disclosed two high-risk vulnerabilities in LiteLLM, the widely used open-source AI gateway downloaded roughly 97 million times a month....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/801e535bbf2b4222f0f62de965c5e322?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/801e535bbf2b4222f0f62de965c5e322?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"IT Security Guru","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"IT Security Guru","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/ae9fe7d07c814192b35f86ad698fb374","url":"https://daily.dev/sources/itsecurityguru"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/litellm-flaws-let-low-privileged-users-hijack-ai-gateway-and-steal-provider-keys-z1eue9ebf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,litellm","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"IT Security Guru","item":"https://daily.dev/sources/itsecurityguru"},{"@type":"ListItem","position":3,"name":"LiteLLM flaws let low-privileged users hijack AI gateway and steal provider keys"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/litellm-flaws-let-low-privileged-users-hijack-ai-gateway-and-steal-provider-keys-z1eue9ebf#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-35029 in LiteLLM and what can an attacker do with it?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-35029 is a missing authorization check on LiteLLM's /config/update endpoint that allows any logged-in user, regardless of role, to modify runtime configuration. Because dashboard session tokens are checked against a prefix-matched route list including /config, attackers could read arbitrary files like /etc/passwd, overwrite UI_USERNAME and UI_PASSWORD to hijack the admin account, or register a malicious pass-through endpoint to achieve remote code execution. daily.dev surfaces vulnerability writeups like this one for teams patching self-hosted AI gateways."}},{"@type":"Question","name":"What version of LiteLLM fixes CVE-2026-35029 and CVE-2026-59823?","acceptedAnswer":{"@type":"Answer","text":"Both vulnerabilities are fixed in LiteLLM version 1.83.9. The flaws were tested against version 1.77.7 and reported through coordinated disclosure starting in October 2025. Organizations should upgrade every deployment, including instances embedded inside other AI platforms and internal tools, since LiteLLM is often bundled without teams realizing it. Developers tracking which dependency version closes a known CVE can follow releases like this on daily.dev."}},{"@type":"Question","name":"How does the LiteLLM SSRF vulnerability CVE-2026-59823 let attackers steal AI provider API keys?","acceptedAnswer":{"@type":"Answer","text":"By passing a user_config parameter to the /chat/completions endpoint, an authenticated user can create a router pointing at a server they control. LiteLLM then sends requests, along with the attached provider API keys for OpenAI, Anthropic, or Google, to that attacker-controlled server instead of the real provider. This code path bypassed existing restrictions on client-supplied api_base and api_key parameters. Teams securing AI gateway credentials can keep up with disclosures like this via daily.dev."}}]} ```