# LiteLLM gateway vulnerabilities: missing authorization, SSRF, file read and RCE (CVE-2026-35029, CVE-2026-59823)

> Check Point Research documents flaws in the LiteLLM AI gateway (tested on v1.77.7): a missing role check on /config/update (CVE-2026-35029) enabling arbitrary file read, admin takeover and RCE, and an SSRF via the user_config request parameter (CVE-2026-59823) that can leak provider API keys. Zenity Labs honeypots recorded exploitation attempts against /config/update starting the day after CVE publication.

- **Published:** 2026-10-13T15:03:29Z
- **Last reviewed:** 2026-10-15T11:52:41.250Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3417
- **ID:** TL-2026-3417
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-35029, CVE-2026-59823

## Description

LiteLLM is an open-source LLM gateway/proxy that fronts many model providers and holds provider API keys, a master key and a database connection. Check Point Research (published 2026-10-13) analysed v1.77.7 and produced working PoCs for several chains.

CVE-2026-35029: POST /config/update does not verify the PROXY_ADMIN role and relies only on the generic user_api_key_auth dependency. Per Check Point, UI login tokens carry team_id 'litellm-dashboard' and route classification uses startswith() prefix matching, so /config/update matches the allowed route /config and any authenticated user can reach it. NVD/Wiz classify it as CWE-863 (CVSS v3.1 8.8 High; v4.0 8.7); Check Point cites CWE-639. Three impact chains were shown. (1) Arbitrary file read: set environment_variables.UI_LOGO_PATH to a target file (e.g. /etc/passwd), then fetch it through the /get_image endpoint, which passes os.getenv('UI_LOGO_PATH') to FileResponse without validation. (2) Admin takeover: overwrite UI_USERNAME and UI_PASSWORD via environment_variables, then log in with the attacker-chosen credentials and obtain PROXY_ADMIN. (3) RCE: add general_settings.pass_through_endpoints with a target such as s3://bucket/adapter.proxy_handler_instance; _update_general_settings() -> initialize_pass_through_endpoints() -> create_pass_through_route() -> get_instance_fn() -> _load_instance_from_remote_storage() downloads the module from S3/GCS and runs spec.loader.exec_module(module), executing attacker top-level Python. SEC Consult independently reported the flaw (discovered 2026-02-24, vendor contacted 2026-02-26, patch 2026-04-01, disclosure 2026-04-21) and demonstrated /etc/passwd exfiltration base64-encoded in an Authorization header via a pass-through endpoint to an attacker server, and extraction of DATABASE_URL.

CVE-2026-59823: an authenticated caller with a valid virtual key can nest api_base inside the user_config request body. The is_request_body_safe guard only inspected top-level api_base/base_url, so user_config builds a new Router with attacker-controlled model_list/api_base, redirecting outbound requests to an attacker host (leaking provider credentials in forwarded headers) or to internal services. GHSA-hx8v-g79f-8w5f; CVSS 5.3 per Mend/Vulert; fixed in 1.83.9 (patch PR #25827). CWE-918.

GHSA-69x8-hrgq-fjj8: user password hashes are exposed to authenticated users and stored with a single unsalted hash iteration (CWE-522, CWE-326); combined with the /config/update authorization bypass this eases offline cracking.

In-the-wild: Zenity Labs ran honeypots Feb-Jun 2026 and saw ~3,900 requests from 73 IPs against the LiteLLM admin API, ~1,000 against /config/update, first attempts 2026-04-07 (one day after CVE publication) and concentrated file-read payloads 2026-05-05 to 2026-05-12 targeting /proc/self/environ, /app/.env and config files. Traffic mostly used no authentication or default keys (sk-1234, sk-litellm-master-key) rather than low-privilege accounts; Zenity reproduced the chains in test environments. Not listed in CISA KEV at time of research. No actor attribution.

Version note: NVD/SEC Consult/Zenity indicate CVE-2026-35029 is fixed in v1.83.0; Check Point recommends v1.83.9+, which also fixes CVE-2026-59823. Upgrading to 1.83.9 or later covers both.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059.006 Command and Scripting Interpreter: Python
- T1098 Account Manipulation
- T1552.001 Unsecured Credentials: Credentials In Files
- T1110.001 Brute Force: Password Guessing
- T1212 Exploitation for Credential Access
- T1005 Data from Local System
- T1020 Automated Exfiltration
- T1136 Create Account
- T1485 Data Destruction
- T1548 Abuse Elevation Control Mechanism
- T1528 Steal Application Access Token
- T1105 Ingress Tool Transfer

## Sources

- [When LLM Gateways Go Wrong: Findings from LiteLLM](https://research.checkpoint.com/2026/when-llm-gateways-go-wrong-findings-from-litellm/)
- [A Read-Only Account is All it Takes to Own a LiteLLM Server](https://labs.zenity.io/post/admin-api-escalation-litellm)
- [Broken Access Control in Config Endpoint in LiteLLM](https://sec-consult.com/vulnerability-lab/advisory/broken-access-control-in-config-endpoint-in-litellm/)
- [NVD CVE-2026-35029](https://nvd.nist.gov/vuln/detail/cve-2026-35029)
- [Wiz Vulnerability Database CVE-2026-35029](https://www.wiz.io/vulnerability-database/cve/cve-2026-35029)
- [NVD CVE-2026-59823](https://nvd.nist.gov/vuln/detail/CVE-2026-59823)
- [GHSA-hx8v-g79f-8w5f LiteLLM SSRF via user_config](https://github.com/BerriAI/litellm/security/advisories/GHSA-hx8v-g79f-8w5f)
- [LiteLLM fix PR #25827](https://github.com/BerriAI/litellm/pull/25827)
- [GHSA-69x8-hrgq-fjj8 password hash exposure](https://github.com/BerriAI/litellm/security/advisories/GHSA-69x8-hrgq-fjj8)
- [CVE-2026-59823 LiteLLM Proxy SSRF (Corgea)](https://corgea.com/advisories/vulnerabilities/CVE-2026-59823)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3417