Summary
- CVE-2026-35029 allowed low-privilege users to alter sensitive proxy configuration.
- CVE-2026-59823 could redirect gateway requests and expose provider API keys.
- Both flaws were fixed in LiteLLM 1.83.9 before the October research publication.
Security researchers at Check Point Research have detailed vulnerabilities in the open-source LiteLLM gateway that could allow a low-privilege user to take control of the service or expose credentials used to connect enterprise applications to external AI providers. The findings, published on 13 October, concern CVE-2026-35029 and CVE-2026-59823 and were resolved in LiteLLM version 1.83.9 before the public technical report.
LiteLLM acts as an intermediary between applications and AI services, providing a common interface through which teams can route requests, administer accounts and manage provider connections. Check Point cites approximately 97 million downloads per month and more than 59,000 GitHub stars as indicators of its reach. These figures describe project activity and popularity, not a verified count of exposed production installations.
The more serious issue, CVE-2026-35029, arose from a missing authorisation check on the gateway’s configuration update endpoint. Check Point found that a user with basic authenticated access, could change settings intended for administrators. Its controlled demonstrations showed routes from that privilege boundary failure to reading server files, changing administrative credentials and executing code through malicious Python modules loaded from cloud storage.
A separate weakness, CVE-2026-59823, affected a client-side credentials feature and could enable server-side request forgery. Under the described conditions, an attacker could redirect calls towards a destination they controlled and capture API credentials intended for legitimate model services. That risk does not depend on breaching OpenAI, Anthropic, Google or any other provider directly. It arises inside the gateway trusted to handle the organisation’s credentials and requests.
The severity labels require precision. Check Point and the public vulnerability records rate the missing authorisation flaw as critical, with a CVSS score of 9.9, while the redirection issue is rated medium, with a score of 5.0. Both have potentially serious consequences in the appropriate environment, but grouping them as two critical CVEs would misstate the published assessment. The research is a disclosure of previously fixed issues, not evidence of a new unpatched zero-day.
The gateway’s position within an AI deployment makes the trust boundary especially sensitive. An internal application might be permitted to submit model requests without being permitted to change global configuration or provider credentials. If those rights become interchangeable, one lower-trust identity can affect services used by multiple teams. A compromised intermediary can also undermine controls that are correctly configured at the upstream AI provider.
Embedded dependencies complicate exposure assessment. LiteLLM may be installed directly or bundled into other platforms, and organisations may not recognise that a particular application contains it. Asset inventories based solely on deliberately procured AI products can therefore miss the version running inside a broader service. Check Point’s research recommends patching and reviewing access controls; neither the report nor the download figures establishes how many companies have actually been compromised.
The distinction between an authenticated user and an administrator is fundamental to the research. A gateway may give many developers access to view request history or usage without allowing them to change service configuration for every user. CVE-2026-35029 crossed that boundary because the endpoint did not enforce the intended role restriction. The separate request-redirection issue concerned where information was sent after the gateway accepted it. Both are conventional software security classes appearing in an AI-specific piece of infrastructure, rather than failures in the underlying model’s capacity to generate safe answers. That distinction affects responsibility.
An organisation can operate a secure account with an upstream provider while its own intermediary mishandles secrets, routing or authorisation. Version 1.83.9 addresses the reported findings, but users still need to know which instances and embedded distributions are installed before declaring their exposure closed. Check Point’s work was carried out on LiteLLM 1.77.7 in a controlled assessment, and its publication does not identify specific customers who lost API keys. The reported mechanisms and tested consequences support remediation without justifying assumptions about widespread compromise.
Mateo Rojas-Carulla, Check Point’s head of research for AI agent security, characterised gateways as a growing security boundary as AI adoption expands. The researchers’ strongest technical evidence remains the documented privilege failure and credential redirection in the tested software, alongside the confirmed fixed version. Further exploitation reports, if any emerge, would need separate verification.
