Check Point discloses LiteLLM flaws CVE-2026-35029 and CVE-2026-59823 enabling gateway takeover and RCE
Check Point researchers disclosed two high-risk vulnerabilities in LiteLLM, an open-source LLM gateway with almost 100,000 downloads a month. The gateway connects enterprise AI applications to providers such as OpenAI, Google and Anthropic. The flaws, CVE-2026-35029 and CVE-2026-59823, could let any user with an account on a vulnerable deployment gain administrative access to the gateway. A successful attacker could take over the system, access files, steal credentials and execute code remotely. The findings were published in a Check Point blog post on October 13. The article does not report in-the-wild exploitation. Versions older than 1.83.9 are affected and the fixes ship in 1.83.9 and later.
Detalhes técnicos
- CVE-2026-35029: a missing authorization check lets low-privileged users reach administrative functions and modify the runtime configuration. This can lead to full system takeover and remote code execution through malicious Python modules loaded from cloud storage.
- CVE-2026-59823: a server-side request forgery (SSRF) flaw lets an attacker redirect the gateway's outbound requests, exposing AI provider API keys.
- LLM gateways centralize credential management, logging, usage tracking, roles and permissions, so they store API keys for every AI provider the organization uses. This makes them high-value targets.
- Mateo Rojas-Carulla of Check Point said anyone holding an account on a vulnerable deployment could take over the gateway. Christopher Jess of Black Duck described the flaws as familiar application security failures.
Remediação
- Update LiteLLM to version 1.83.9 or later.
- Audit user accounts and remove those no longer needed, since any account can be used to exploit the flaws.
- Rotate AI provider API keys stored in LiteLLM if unauthorized access before patching is suspected.
- Verify that limited roles are actually enforced in practice.
- Include LLM gateways in penetration tests and vulnerability assessments alongside web applications and cloud infrastructure.
Linha do tempo
-
Check Point discloses LiteLLM flaws CVE-2026-35029 and CVE-2026-59823 enabling gateway takeover and RCE
ler a análise desta fonte ocultar
Check Point researchers disclosed two high-risk vulnerabilities in LiteLLM, an open-source LLM gateway with almost 100,000 downloads a month. The gateway connects enterprise AI applications to providers such as OpenAI, Google and Anthropic. The flaws, CVE-2026-35029 and CVE-2026-59823, could let any user with an account on a vulnerable deployment gain administrative access to the gateway. A successful attacker could take over the system, access files, steal credentials and execute code remotely. The findings were published in a Check Point blog post on October 13. The article does not report in-the-wild exploitation. Versions older than 1.83.9 are affected and the fixes ship in 1.83.9 and later.
Technical Details
- CVE-2026-35029: a missing authorization check lets low-privileged users reach administrative functions and modify the runtime configuration. This can lead to full system takeover and remote code execution through malicious Python modules loaded from cloud storage.
- CVE-2026-59823: a server-side request forgery (SSRF) flaw lets an attacker redirect the gateway's outbound requests, exposing AI provider API keys.
- LLM gateways centralize credential management, logging, usage tracking, roles and permissions, so they store API keys for every AI provider the organization uses. This makes them high-value targets.
- Mateo Rojas-Carulla of Check Point said anyone holding an account on a vulnerable deployment could take over the gateway. Christopher Jess of Black Duck described the flaws as familiar application security failures.
Remediation
- Update LiteLLM to version 1.83.9 or later.
- Audit user accounts and remove those no longer needed, since any account can be used to exploit the flaws.
- Rotate AI provider API keys stored in LiteLLM if unauthorized access before patching is suspected.
- Verify that limited roles are actually enforced in practice.
- Include LLM gateways in penetration tests and vulnerability assessments alongside web applications and cloud infrastructure.