--- title: When LLM Gateways Go Wrong: Findings from LiteLLM description: A security assessment of LiteLLM version 1.77.7, a popular open-source LLM gateway, uncovered multiple high-severity vulnerabilities tracked as CVE-2026-35029... canonical: https://daily.dev/posts/when-llm-gateways-go-wrong-findings-from-litellm-cg5i3uzub twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: When LLM Gateways Go Wrong: Findings from LiteLLM | daily.dev og:description: A security assessment of LiteLLM version 1.77.7, a popular open-source LLM gateway, uncovered multiple high-severity vulnerabilities tracked as CVE-2026-35029... og:url: https://daily.dev/posts/when-llm-gateways-go-wrong-findings-from-litellm-cg5i3uzub og:image: https://api.daily.dev/og/posts/Cg5I3UzUB.png og:image:alt: When LLM Gateways Go Wrong: Findings from LiteLLM og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # When LLM Gateways Go Wrong: Findings from LiteLLM **[Check Point Research](https://daily.dev/sources/cpresearch)** · 14 min read · 0 upvotes · 0 comments ## Summary A security assessment of LiteLLM version 1.77.7, a popular open-source LLM gateway, uncovered multiple high-severity vulnerabilities tracked as CVE-2026-35029 and CVE-2026-59823, fixed in version 1.83.9. The core issue was a missing role-based access control check on the /config/update endpoint, which let any authenticated user, even low-privileged ones, modify the proxy's runtime configuration. This enabled arbitrary file reads via environment variable injection, administrative account takeover by overwriting UI_USERNAME/UI_PASSWORD, and remote code execution through malicious Python modules loaded from S3 or GCS via pass-through endpoints. A separate SSRF flaw in the Clientside LLM Credentials feature let attackers redirect API calls to exfiltrate provider keys. Additional weaknesses included exposed, weakly-hashed password hashes. All issues were disclosed through coordinated disclosure and patched. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-35029 in LiteLLM and how does it work? CVE-2026-35029 is a missing authorization check on the POST /config/update endpoint in LiteLLM versions before 1.83.9, including the tested 1.77.7. Because the endpoint only verified a generic authenticated session rather than checking for the PROXY_ADMIN role, any authenticated user, including low-privileged Internal User accounts, could modify the proxy's runtime configuration, including environment variables and pass-through endpoints. _Teams running LLM gateways can track emerging CVEs like this one on daily.dev before they hit production._ ### How can attackers achieve remote code execution through LiteLLM's pass-through endpoints feature? Attackers exploit the /config/update endpoint by registering a pass-through endpoint whose target parameter points to an s3:// or gcs:// URL. LiteLLM downloads the referenced Python file and executes it via importlib's exec_module, running any top-level code including import-time side effects, giving an attacker full code execution on the gateway host without needing admin privileges first. _Developers securing AI infrastructure can follow writeups like this on daily.dev to catch dynamic-loading risks early._ ### How does the LiteLLM Clientside LLM Credentials feature create an SSRF vulnerability? The /chat/completions endpoint accepts a user_config parameter that lets a caller instantiate a new router with an arbitrary api_base URL, with no validation applied. This bypasses the configurable_clientside_auth_params restrictions meant to block direct api_base and api_key overrides, letting an attacker redirect LLM API calls to a server they control and capture the original provider API key in transit. _Anyone evaluating LLM gateway security can use coverage like this on daily.dev to weigh SSRF exposure before adoption._ ## Similar posts on daily.dev - [LiteLLM Vulnerability Chain: What Security Teams Running AI Gateways Need to Do Now](https://daily.dev/posts/litellm-vulnerability-chain-what-security-teams-running-ai-gateways-need-to-do-now-2dh1t9pl9) · Latest Hacking News · 0 upvotes · 0 comments - [Hackers are exploiting a critical LiteLLM pre-auth SQLi flaw](https://daily.dev/posts/hackers-are-exploiting-a-critical-litellm-pre-auth-sqli-flaw-zfoa4stcb) · BleepingComputer · 0 upvotes · 0 comments - [What the LiteLLM Breach Teaches Us About Securing LLM Gateways](https://daily.dev/posts/what-the-litellm-breach-teaches-us-about-securing-llm-gateways-ysbbrmwzu) · Medium · 0 upvotes · 0 comments - [LLM Heist: Hijacking LiteLLM for Traffic Interception, Key Theft, and Tool-Call Injection · Embrace The Red](https://daily.dev/posts/llm-heist-hijacking-litellm-for-traffic-interception-key-theft-and-tool-call-injection-embrace--li9gykium) · Embrace The Red · 0 upvotes · 0 comments - [LLMs on Kubernetes: Same Cluster, Different Threat Model](https://daily.dev/posts/llms-on-kubernetes-same-cluster-different-threat-model-pwv5wm3sx) · MetalBear · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#litellm](https://daily.dev/tags/litellm) [View this post on daily.dev](https://daily.dev/posts/when-llm-gateways-go-wrong-findings-from-litellm-cg5i3uzub) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"When LLM Gateways Go Wrong: Findings from LiteLLM","url":"https://daily.dev/posts/when-llm-gateways-go-wrong-findings-from-litellm-cg5i3uzub","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/when-llm-gateways-go-wrong-findings-from-litellm-cg5i3uzub"},"datePublished":"2026-10-13T14:34:37.475Z","dateModified":"2026-10-13T15:13:29.327Z","description":"A security assessment of LiteLLM version 1.77.7, a popular open-source LLM gateway, uncovered multiple high-severity vulnerabilities tracked as CVE-2026-35029...","image":"https://media.daily.dev/image/upload/s--VDukGCjf--/f_auto/v1722860399/public/Placeholder%2002","thumbnailUrl":"https://media.daily.dev/image/upload/s--VDukGCjf--/f_auto/v1722860399/public/Placeholder%2002","isAccessibleForFree":true,"articleSection":"Check Point Research","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Check Point Research","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/7e3b130555214df2bf737ee6c764fa42","url":"https://daily.dev/sources/cpresearch"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/when-llm-gateways-go-wrong-findings-from-litellm-cg5i3uzub","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,litellm","timeRequired":"PT14M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Check Point Research","item":"https://daily.dev/sources/cpresearch"},{"@type":"ListItem","position":3,"name":"When LLM Gateways Go Wrong: Findings from LiteLLM"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/when-llm-gateways-go-wrong-findings-from-litellm-cg5i3uzub#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-35029 in LiteLLM and how does it work?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-35029 is a missing authorization check on the POST /config/update endpoint in LiteLLM versions before 1.83.9, including the tested 1.77.7. Because the endpoint only verified a generic authenticated session rather than checking for the PROXY_ADMIN role, any authenticated user, including low-privileged Internal User accounts, could modify the proxy's runtime configuration, including environment variables and pass-through endpoints. Teams running LLM gateways can track emerging CVEs like this one on daily.dev before they hit production."}},{"@type":"Question","name":"How can attackers achieve remote code execution through LiteLLM's pass-through endpoints feature?","acceptedAnswer":{"@type":"Answer","text":"Attackers exploit the /config/update endpoint by registering a pass-through endpoint whose target parameter points to an s3:// or gcs:// URL. LiteLLM downloads the referenced Python file and executes it via importlib's exec_module, running any top-level code including import-time side effects, giving an attacker full code execution on the gateway host without needing admin privileges first. Developers securing AI infrastructure can follow writeups like this on daily.dev to catch dynamic-loading risks early."}},{"@type":"Question","name":"How does the LiteLLM Clientside LLM Credentials feature create an SSRF vulnerability?","acceptedAnswer":{"@type":"Answer","text":"The /chat/completions endpoint accepts a user_config parameter that lets a caller instantiate a new router with an arbitrary api_base URL, with no validation applied. This bypasses the configurable_clientside_auth_params restrictions meant to block direct api_base and api_key overrides, letting an attacker redirect LLM API calls to a server they control and capture the original provider API key in transit. Anyone evaluating LLM gateway security can use coverage like this on daily.dev to weigh SSRF exposure before adoption."}}]} ```