Threat reportVulnerabilityTL-2026-3417
LiteLLM gateway vulnerabilities: missing authorization, SSRF, file read and RCE (CVE-2026-35029, CVE-2026-59823)
LiteLLM gateway vulnerabilities (TL-2026-3417), also tracked as GHSA-53mr-6c8q-9789, is a high-severity software vulnerability scored CVSS 8.8, first published 2026-10-13 and last reviewed 2026-10-15. It has no confirmed attribution, affects BerriAI LiteLLM (Proxy / AI Gateway), references 2 CVEs (CVE-2026-35029, CVE-2026-59823), maps to 14 MITRE ATT&CK techniques (T1005, T1020, T1059.006), and is covered by 9 detection rules and 22 indicators of compromise.
- CVSS
- 8.8/10High
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 14MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 22Indicators of compromise
Key facts for TL-2026-3417
- Threat ID
- TL-2026-3417
- Also known as
- GHSA-53mr-6c8q-9789, GHSA-hx8v-g79f-8w5f, GHSA-69x8-hrgq-fjj8, CPAI-2026-4191
- Severity
- HIGH
- CVSS
- 8.8
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, finance, health, government administration
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 22
- Updates
- 2026-10-15 · revalidated 1× · latest source
Malware and tooling in LiteLLM gateway vulnerabilities
Malware and tooling: Python
How LiteLLM gateway vulnerabilities works
Check Point Research documents flaws in the LiteLLM AI gateway (tested on v1.77.7): a missing role check on /config/update (CVE-2026-35029) enabling arbitrary file read, admin takeover and RCE, and an SSRF via the user_config request parameter (CVE-2026-59823) that can leak provider API keys. Zenity Labs honeypots recorded exploitation attempts against /config/update starting the day after CVE publication.
LiteLLM is an open-source LLM gateway/proxy that fronts many model providers and holds provider API keys, a master key and a database connection. Check Point Research (published 2026-10-13) analysed v1.77.7 and produced working PoCs for several chains.
CVE-2026-35029: POST /config/update does not verify the PROXY_ADMIN role and relies only on the generic user_api_key_auth dependency. Per Check Point, UI login tokens carry team_id 'litellm-dashboard' and route classification uses startswith() prefix matching, so /config/update matches the allowed route /config and any authenticated user can reach it. NVD/Wiz classify it as CWE-863 (CVSS v3.1 8.8 High; v4.0 8.7); Check Point cites CWE-639. Three impact chains were shown. (1) Arbitrary file read: set environment_variables.UI_LOGO_PATH to a target file (e.g. /etc/passwd), then fetch it through the /get_image endpoint, which passes os.getenv('UI_LOGO_PATH') to FileResponse without validation. (2) Admin takeover: overwrite UI_USERNAME and UI_PASSWORD via environment_variables, then log in with the attacker-chosen credentials and obtain PROXY_ADMIN. (3) RCE: add general_settings.pass_through_endpoints with a target such as s3://bucket/adapter.proxy_handler_instance; _update_general_settings() -> initialize_pass_through_endpoints() -> create_pass_through_route() -> get_instance_fn() -> _load_instance_from_remote_storage() downloads the module from S3/GCS and runs spec.loader.exec_module(module), executing attacker top-level Python. SEC Consult independently reported the flaw (discovered 2026-02-24, vendor contacted 2026-02-26, patch 2026-04-01, disclosure 2026-04-21) and demonstrated /etc/passwd exfiltration base64-encoded in an Authorization header via a pass-through endpoint to an attacker server, and extraction of DATABASE_URL.
CVE-2026-59823: an authenticated caller with a valid virtual key can nest api_base inside the user_config request body. The is_request_body_safe guard only inspected top-level api_base/base_url, so user_config builds a new Router with attacker-controlled model_list/api_base, redirecting outbound requests to an attacker host (leaking provider credentials in forwarded headers) or to internal services. GHSA-hx8v-g79f-8w5f; CVSS 5.3 per Mend/Vulert; fixed in 1.83.9 (patch PR #25827). CWE-918.
GHSA-69x8-hrgq-fjj8: user password hashes are exposed to authenticated users and stored with a single unsalted hash iteration (CWE-522, CWE-326); combined with the /config/update authorization bypass this eases offline cracking.
In-the-wild: Zenity Labs ran honeypots Feb-Jun 2026 and saw ~3,900 requests from 73 IPs against the LiteLLM admin API, ~1,000 against /config/update, first attempts 2026-04-07 (one day after CVE publication) and concentrated file-read payloads 2026-05-05 to 2026-05-12 targeting /proc/self/environ, /app/.env and config files. Traffic mostly used no authentication or default keys (sk-1234, sk-litellm-master-key) rather than low-privilege accounts; Zenity reproduced the chains in test environments. Not listed in CISA KEV at time of research. No actor attribution.
Version note: NVD/SEC Consult/Zenity indicate CVE-2026-35029 is fixed in v1.83.0; Check Point recommends v1.83.9+, which also fixes CVE-2026-59823. Upgrading to 1.83.9 or later covers both.
MITRE ATT&CK techniques used in TL-2026-3417
Collection
Exfiltration
Execution
T1059.006 Command and Scripting Interpreter: Python
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Persistence
T1098 Account Manipulation; T1136 Create Account
Command and Control
Credential Access
T1110.001 Brute Force: Password Guessing; T1212 Exploitation for Credential Access; T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files
Impact
Privilege Escalation
Affected products and versions in LiteLLM gateway vulnerabilities
- BerriAI — LiteLLM (Proxy / AI Gateway)
Vulnerable versions: < 1.83.0 (CVE-2026-35029); <= 1.83.8 (CVE-2026-59823); 1.77.7 (tested by Check Point)
Fixed in: 1.83.0 (CVE-2026-35029); 1.83.9 and later
Remediation for LiteLLM gateway vulnerabilities
Patches
- LiteLLM v1.83.0 (fixes CVE-2026-35029 per NVD)
- LiteLLM v1.83.9 (fixes CVE-2026-59823; recommended by Check Point)
Immediate actions
- Upgrade LiteLLM to v1.83.9 or later
- Rotate LITELLM_MASTER_KEY away from defaults such as sk-1234 and sk-litellm-master-key
- Rotate provider API keys, DATABASE_URL credentials, Langfuse keys and admin credentials if a vulnerable version was exposed
- Hunt proxy access logs for POST /config/update and GET /get_image, and for user_config in request bodies
Workarounds
- SEC Consult reports no workaround for CVE-2026-35029; block /config/update at a reverse proxy for non-admin networks
- Disable remote S3/GCS module loading for pass-through endpoints where possible
Longer-term hardening
- Restrict network access to the LiteLLM management/control plane
- Restrict distribution of read-only and virtual keys; use least privilege
- Egress-filter the gateway host to approved LLM provider endpoints and S3/GCS locations
- Migrate password storage to salted adaptive hashing (Argon2/bcrypt/scrypt)
CVEs associated with LiteLLM gateway vulnerabilities
Weaknesses (CWE) in LiteLLM gateway vulnerabilities
Timeline of LiteLLM gateway vulnerabilities
- SEC Consult discovers the missing authorization in LiteLLM /config/update (tested on v1.81.12).
- SEC Consult contacts the vendor (BerriAI) about the vulnerability.
- Patched LiteLLM release (v1.83.0) made available per SEC Consult.
- GitHub advisory GHSA-53mr-6c8q-9789 published for the unrestricted /config/update endpoint; fixed in LiteLLM 1.83.0 by requiring the proxy_admin role.
- CVE-2026-35029 published (CVSS v3.1 8.8, CWE-863); public PoC and Nuclei templates follow.
- Zenity honeypots record the first /config/update targeting attempts, one day after CVE publication.
- LiteLLM v1.83.9 released, fixing the user_config SSRF (later CVE-2026-59823).
- SEC Consult publishes its coordinated advisory with PoC for CVE-2026-35029.
- Honeypots see concentrated UI_LOGO_PATH file-read payloads (through 2026-05-12) targeting .env, config and /proc/self/environ files.
- Zenity Labs publicly reports attackers weaponizing enterprise AI infrastructure (about 3,900 requests from 73 IPs between February and June 2026).
- Zenity Labs publishes the LiteLLM admin API escalation research and honeypot findings for CVE-2026-35029.
- CVE-2026-59823 / GHSA-hx8v-g79f-8w5f (SSRF via user_config) published.
- Check Point Research publishes PoCs for file read, admin takeover, RCE and SSRF credential extraction on LiteLLM v1.77.7.
Update history for TL-2026-3417
- 2026-10-15 — LiteLLM LLM Gateway Vulnerabilities: Missing Authorization (CVE-2026-35029) and SSRF (CVE-2026-59823): What changed No severity, exploitability, status or CVSS change; existing record already ACTIVE / PATCHED / HIGH. New indicators (2) Added /chat/completions (user_config.api_base SSRF vector) and the guessed master key sk-admin. The PoC lis
Sources cited for LiteLLM gateway vulnerabilities
- When LLM Gateways Go Wrong: Findings from LiteLLM
- A Read-Only Account is All it Takes to Own a LiteLLM Server
- Broken Access Control in Config Endpoint in LiteLLM
- NVD CVE-2026-35029
- Wiz Vulnerability Database CVE-2026-35029
- NVD CVE-2026-59823
- GHSA-hx8v-g79f-8w5f LiteLLM SSRF via user_config
- LiteLLM fix PR #25827
- GHSA-69x8-hrgq-fjj8 password hash exposure
- CVE-2026-59823 LiteLLM Proxy SSRF (Corgea)
Detection coverage for TL-2026-3417
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3417 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.