/
← Voltar ao feed
high

Check Point Research discloses two high-risk LiteLLM LLM gateway flaws, CVE-2026-35029 and CVE-2026-59823

1 fonte(s) · 1 atualização(ões) · publicado 13/10/2026 09:00 · coletado há 1 dia

Baseado só no resumo do feed. O site da fonte não liberou o texto completo para o Tifon, então esta análise saiu apenas do resumo publicado no feed e pode estar incompleta. Ela é atualizada quando outra fonte cobrir o assunto. Ler na fonte original ↗

Check Point Research disclosed two high-risk vulnerabilities in LiteLLM, the open source LLM gateway that organizations use to connect applications to AI providers such as OpenAI, Google and Anthropic. The project is widely deployed, with about 97 million downloads per month and over 59,000 GitHub stars. CVE-2026-35029 let any user, including those with read-only access, reach administrative functions and take over the gateway. CVE-2026-59823 let attackers redirect something, but the article excerpt is truncated and does not say what. The excerpt does not report active exploitation.

Technical Details

  • CVE-2026-35029: an access control flaw that exposed administrative functions to low-privileged users, including read-only ones, and could lead to full gateway takeover.
  • CVE-2026-59823: the impact is cut off in the available text ("allowed attackers to redirect […]").
  • Affected versions, CVSS scores and exploitation details are not given in the excerpt.

Remediation

The excerpt does not give patch guidance. Defenders running LiteLLM should check the vendor and Check Point advisories for fixed versions and apply updates. They should also review who has access to the gateway.

Linha do tempo

  1. blog.checkpoint.com ↗ · pub. 13/10/2026 09:00 · coletado 19/10 17:57 primeiro registro só resumo do feed

    Check Point Research discloses two high-risk LiteLLM LLM gateway flaws, CVE-2026-35029 and CVE-2026-59823

    ler a análise desta fonte

    Check Point Research disclosed two high-risk vulnerabilities in LiteLLM, the open source LLM gateway that organizations use to connect applications to AI providers such as OpenAI, Google and Anthropic. The project is widely deployed, with about 97 million downloads per month and over 59,000 GitHub stars. CVE-2026-35029 let any user, including those with read-only access, reach administrative functions and take over the gateway. CVE-2026-59823 let attackers redirect something, but the article excerpt is truncated and does not say what. The excerpt does not report active exploitation.

    Technical Details

    • CVE-2026-35029: an access control flaw that exposed administrative functions to low-privileged users, including read-only ones, and could lead to full gateway takeover.
    • CVE-2026-59823: the impact is cut off in the available text ("allowed attackers to redirect […]").
    • Affected versions, CVSS scores and exploitation details are not given in the excerpt.

    Remediation

    The excerpt does not give patch guidance. Defenders running LiteLLM should check the vendor and Check Point advisories for fixed versions and apply updates. They should also review who has access to the gateway.