The Pulse
Check Point Finds Two LiteLLM Flaws That Could Expose AI Gateways
Check Point Research disclosed two LiteLLM vulnerabilities that could let authenticated users take over gateway settings or redirect AI requests to steal provider credentials. LiteLLM fixed the flaws in version 1.83.9, and Check Point urged
AI.info Team · Written with AI ·
“This single flaw enabled arbitrary file read, administrative account takeover, and remote code execution via malicious Python modules loaded from cloud storage.”
The authors of “When LLM Gateways Go Wrong: Findings from LiteLLM”
Check Point Research published details of two LiteLLM vulnerabilities on October 13, warning that an authenticated user could gain control of gateway settings or redirect AI requests to capture provider keys. The researchers tested LiteLLM version 1.77.7 and said both issues were fixed in version 1.83.9. Their demonstrations took place in a controlled test environment; the report does not say the flaws were exploited in real-world attacks.
A missing role check opened the configuration endpoint
The more severe flaw, CVE-2026-35029, involved LiteLLM’s POST /config/update endpoint, which can change runtime settings such as environment variables and model lists. Check Point found that the endpoint checked whether a user was authenticated but did not verify that the user had the administrator role. A broad route rule for dashboard sessions also treated routes beginning with /config as permitted, allowing low-privilege users to reach the update function.
That access could let an attacker change the proxy’s configuration and read files accessible to the LiteLLM process, including files containing secrets. Check Point also demonstrated how a modified configuration could overwrite administrator credentials or make LiteLLM download and execute a Python module hosted in cloud storage. The researchers used a harmless proof of concept that created a marker directory to confirm code execution; they said a malicious payload could instead run other code.
A second flaw could send provider keys elsewhere
CVE-2026-59823 affected LiteLLM’s “Clientside LLM Credentials” feature. The researchers found that a caller could place attacker-controlled routing settings inside the user_config request parameter, causing the gateway to send an API request to a destination of the caller’s choosing. The outbound request could include provider credentials already configured in the gateway.
Because LiteLLM often sits between applications and AI providers, a stolen key could expose an organization to unauthorized use of its provider account and resulting charges. The gateway also manages routing and credentials in one place, making its permissions consequential beyond the application that happens to send a particular prompt. Check Point said LiteLLM had 97 million monthly downloads and more than 59,000 GitHub stars when it published its disclosure.
Version 1.83.9 contains the fixes
Check Point said it began coordinated disclosure with LiteLLM maintainers in October 2025 and that the issues were resolved in version 1.83.9. The project’s GitHub advisory for CVE-2026-59823 identifies versions through 1.83.8 as affected and names 1.83.9 as patched. Check Point advised organizations on earlier versions to update and review which accounts can access their gateways.
The researchers also recommended rotating stored provider keys if there is evidence of unauthorized access, and checking LiteLLM deployments that run indirectly inside other platforms or internal tools. That matters for teams whose software inventory tracks only standalone installations: a gateway can be present even when no team knowingly deployed it as a separate service. The operative check is the version running in every deployment, including gateways bundled inside internal tools.