Two vulnerabilities in LiteLLM: From Internal User to RCE

Two vulnerabilities in LiteLLM: From Internal User to RCE

Check Point Research investigated LiteLLM Proxy 1.77.7 and discovered two vulnerabilities.

The first vulnerability, CVE-2026-35029, is an access control violation affecting POST /config/update. When logging into the LiteLLM web interface, LiteLLM issues a UI token with team_id=litellm-dashboard. The allowed-route check uses startswith(): because /config is present in the list, the token also gains access to /config/update. The handler itself does not check for the PROXY_ADMIN role. As a result, even a user with the Internal User role can modify the gateway configuration.

The researchers demonstrated three scenarios: • File reading: setting UI_LOGO_PATH to the path of a local file and retrieving its contents through GET /get_image; • Administrator takeover: changing UI_USERNAME and UI_PASSWORD, after which the attacker logs in as PROXY_ADMIN; • RCE: adding general_settings.pass_through_endpoints with a target pointing to a Python module in S3 or GCS. When updating the configuration, LiteLLM downloads the module and executes its code through importlib and exec_module().

The second vulnerability, CVE-2026-59823, is an SSRF in the Clientside LLM Credentials mechanism. The user_config parameter in /chat/completions allows the creation of a router with an arbitrary api_base, bypassing restrictions on the usual api_base and api_key parameters. In the PoC, the gateway sent a request to the researchers’ server along with the LLM provider’s API key, added to the headers. Exploitation requires authenticated access.

The vulnerability was fixed in LiteLLM 1.83.9.

Article: https://research.checkpoint.com/2026/when-llm-gateways-go-wrong-findings-from-litellm/