Check Point Discovers LiteLLM Vulnerabilities Allowing Admin Takeover and API Key Theft

Post Views: 10

Check Point Research uncovered two significant security vulnerabilities in LiteLLM, an open-source AI gateway designed to interface applications with AI service providers like OpenAI, Google, and Anthropic.

Missing Authorization Enables Gateway Compromise

CVE-2026-35029

The most severe vulnerability, tracked as CVE-2026-35029, stems from a lack of proper authorization checks on the /config/update endpoint. This endpoint manages runtime configurations for the gateway. A flaw in how user interface tokens were validated allowed low-privilege users to alter settings typically reserved for administrators.

By modifying environment variables through the environment_variables parameter, attackers could execute multiple attack vectors. For instance, injecting custom variables into os.environ to adjust the UI_LOGO_PATH parameter enabled the retrieval of sensitive internal files, including system secrets, via the /get_image endpoint.

Administrative control was also at risk. Changing UI_USERNAME and UI_PASSWORD environment variables allowed attackers to override proxy credentials, granting access to the /login route and full PROXY_ADMIN privileges. This could result in the takeover of default administrative accounts.

Additionally, the vulnerability facilitated remote code execution (RCE). LiteLLM’s support for custom pass-through endpoints, which load Python modules from cloud storage, created an entry point. Attackers could configure these endpoints to load malicious modules from services like Amazon S3 or Google Cloud Storage, executing arbitrary code on the gateway server.

SSRF Flaw Exposes AI Provider API Keys

CVE-2026-59823

The second vulnerability, CVE-2026-59823, involves a Server-Side Request Forgery (SSRF) flaw within the Clientside LLM Credentials feature. The /chat/completions endpoint accepts a user_config parameter that allows authenticated users to specify custom routing settings. However, insufficient validation of this parameter enabled attackers to redirect AI requests to servers they controlled.

By exploiting this flaw, attackers could intercept API keys stored in the gateway’s default headers, capturing credentials that should remain inaccessible. This method bypassed standard security measures, exposing sensitive information tied to AI provider integrations.

Mitigation and Additional Security Concerns

Check Point also identified exposed password hashes and weak storage practices that simplified their decryption. These issues were linked to GitHub Security Advisory GHSA-698-hrgq-fjj8. The vulnerabilities were resolved in LiteLLM version 1.83.9 and later. Organizations using older versions are advised to upgrade and review access controls for their gateways. If unauthorized access is suspected, rotating affected AI provider API keys is recommended.

Expert Perspectives

Li Zhao, a Principal Strategic Services Consultant at Black Duck, emphasized that these vulnerabilities reflect well-known application security issues but amplify their impact when applied to AI systems. “LLM gateways act as centralized trust brokers in enterprise environments, managing API credentials, request routing, and access controls. Flaws in these components can have cascading effects,” Zhao noted.

Boris Cipot, a Principal Security Engineer at Black Duck, warned that attackers may prioritize targeting AI gateways over direct breaches of major providers. “The software connecting organizations to AI services is often a more attractive target than the providers themselves. Its integration into other platforms and internal tools makes it harder to detect and mitigate,” Cipot said.

The vulnerabilities add to a challenging period for LiteLLM’s security posture, following a March 2026 supply-chain attack where malicious package versions (1.82.7 and 1.82.8) were published to PyPI by the threat group TeamPCP.