LiteLLM — Security Breaches in AI Gateways: Remote Code Execution and Access Control Bypass (CVE-2026-35029)

Publication date: October 13, 2026
Category: AI attacks (LLM/LocalAI)

Introduction

A security assessment exposed multiple high-impact vulnerabilities in LiteLLM (v1.77.7), a widely adopted open-source proxy and gateway designed for interacting with Large Language Models (LLMs). The discovered flaws, tracked as CVE-2026-35029 and CVE-2026-59823, permit low-privileged authenticated users to execute critical actions such as modifying runtime configuration, reading sensitive server files, seizing administrative accounts, executing arbitrary remote code, and exfiltrating AI provider keys via Server-Side Request Forgery (SSRF).

What is LiteLLM and its Risks in AI Architectures? (General Analysis)

LLM gateways act as intermediaries between client applications and various artificial intelligence model providers (such as OpenAI, Anthropic, and others). Their core purpose is to unify connection logic, manage credentials, enforce usage quotas, balance workloads, and centralize audit logging.

However, occupying a privileged position in the request path and managing highly sensitive credentials means any security flaw in their architecture compromises the entire connected infrastructure. In LiteLLM, the detected weaknesses stem from insufficient role-based access control (RBAC) validation and a lack of proper sanitization for custom configuration parameters.

Official data verified by the National Vulnerability Database (NVD) includes:

  • CVE-2026-35029 (Official NVD Data):
    • Official CVSS v4.0 Score: 8.7 (HIGH) — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/...
    • Official CWE Classification: CWE-863 (Incorrect Authorization), CWE-425 (Direct Request (‘Forced Browsing’))
    • CISA KEV Status: Not reported
  • CVE-2026-59823 (Official NVD Data):
    • Official CVSS v4.0 Score: 5.3 (MEDIUM) — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/...
    • Official CWE Classification: CWE-918 (Server-Side Request Forgery - SSRF)
    • CISA KEV Status: Not reported

How Does It Work? (Technical Analysis)

The technical analysis reveals multiple exploitation vectors leveraging logic flaws and access control deficiencies within the proxy interface:

  • Authorization Bypass in the Configuration Endpoint (/config/update): The proxy exposes a configuration update endpoint lacking proper verification of the PROXY_ADMIN role. Sessions initiated via the UI generate a token associated with the litellm-dashboard team, which successfully passes allowed route validations (startswith("/config")), enabling any authenticated low-level user to issue modification requests.
  • Arbitrary File Read (CVE-2026-35029): By injecting the UI_LOGO_PATH environment variable through the vulnerable endpoint, an attacker can alter the file path served by /get_image. Pointing this to sensitive system files (such as /etc/passwd) results in the server returning file contents without prior validation.
  • Administrative Account Takeover: Modifying the UI_USERNAME and UI_PASSWORD environment variables permits overwriting default administrative access credentials, facilitating a full Proxy Admin session.
  • Remote Code Execution (RCE): Defining pass-through endpoints allows specifying cloud storage destinations (s3:// or gcs://). LiteLLM downloads and processes Python modules via importlib.util.spec_from_file_location, enabling the execution of attacker-controlled code.
  • SSRF and Provider Key Extraction (CVE-2026-59823): The user_config parameter within the request body of /chat/completions bypasses security mechanisms blocking direct modifications to api_base. This permits redirecting network calls to attacker-controlled servers and exfiltrating primary API keys.

Affected Systems / Environments

The flaws directly impact LiteLLM proxy server deployments prior to official security patches:

  • LiteLLM Proxy Server: Versions prior to v1.83.0 (affected by CVE-2026-35029).
  • LiteLLM Proxy Server: Versions prior to v1.83.9 (affected by CVE-2026-59823).
  • Environments: Self-hosted container deployments (Docker), Kubernetes clusters, and enterprise AI integrations utilizing the gateway as a model request intermediary.
CVE Category (CWE) Impact CVSS Vector (Summary)
CVE-2026-35029 CWE-863, CWE-425 RCE, File Read, Takeover 8.7 (High) AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H
CVE-2026-59823 CWE-918 (SSRF) API Key Exfiltration 5.3 (Medium) AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N

Mitigation and Detection

Remediation

  • Software Update: Immediately upgrade LiteLLM to version 1.83.9 or higher, which includes cumulative patches addressing both vulnerability vectors.
  • Access Control: Strictly restrict internal network access and limit the issuance of session tokens carrying dashboard privileges (litellm-dashboard).
  • Environment Variable Hardening: Audit current configuration values for anomalous alterations in critical variables such as UI_LOGO_PATH, UI_USERNAME, and external routing parameters.

Detection

Defensive teams should monitor access logs for anomalous HTTP POST requests directed toward /config/update originating from non-administrative accounts, as well as requests to the /get_image endpoint containing absolute operating system paths or suspicious external URLs.

Defensive Warning: Exposing unpatched AI gateways facilitates remote code execution within internal networks and the capture of multi-provider corporate model secrets.

regex 
# Analytical regex rule for detecting suspicious HTTP POST requests to /config/update in web logs
^.*POST\s+/config/update\s+HTTP\/.*$

Wrapping Up

The analysis of vulnerabilities in LiteLLM highlights how the rapid evolution and adoption of tools within the AI ecosystem frequently overlook fundamental security principles such as role-based access control and strict input sanitization. An initial authorization omission cascaded into multiple critical compromise vectors, demonstrating the necessity of applying rigorous defensive engineering practices to language model infrastructures.

References