Exploitation observed; activity peaked at 4 mentions and remains active
Immediate actions
Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Recommended action window: Immediate (within 24h)
NVD description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.9, an authenticated LiteLLM Proxy caller with a valid virtual key can place api_base inside the user_config request body to bypass is_request_body_safe, which blocks top-level api_base and base_url but previously did not inspect or reject user_config. Because user_config constructs the outbound router, the nested destination redirects a server-side request to an internal or external host selected by the caller and can expose endpoints the caller cannot otherwise access. This issue is fixed in version 1.83.9.
LiteLLM CRITICAL CVE-2026-35029 + CVE-2026-59823
Auth bypass + SSRF in #1 open-source AI gateway → full AI pipeline compromise.Unauth POST to /config/update → steal downstream API keys for OpenAI, Anthropic, Gemini, Bedrock + prompt data.100k downloads/mo — patch to 1.83.9 NOW https://t.co/D2QaIY44sv
Post summary
The tweet discloses two critical CVEs in LiteLLM (auth bypass and SSRF) enabling full AI pipeline compromise and API key theft, urgently directing users to upgrade to version 1.83.9.
Your AI gateway might be your biggest breach vector:
LiteLLM- 97M downloads/mo suffers from 2 critical RCEs:
1) CVE-2026-35029: read-only user → admin → RCE
2) CVE-2026-59823: redirect → steal your OpenAI/Anthropic/Google API keys https://t.co/APfUYNXUqv
Post summary
The tweet announces two critical RCE vulnerabilities in LiteLLM (CVE-2026-35029 and CVE-2026-59823), describing their attack vectors and potential impact, with a link to further details.
The scariest infra pattern this month isn't in your code. It's in the AI gateway in front of it. Last week, Check Point Research disclosed two new LiteLLM flaws — CVE-2026-35029 and CVE-2026-59823 — that turn any low-privilege gateway account into a full takeover.
And they're not even the first LiteLLM auth-class bug this year.
Attribution matters, so let's get it right: these are not bugs in Check Point's products.
Check Point's research team audited LiteLLM — the open-source LLM gateway much of the industry puts in front of its model providers — and found its control plane can't tell users apart from admins.
CVE-2026-35029 is a missing authorization check on POST /config/update. Any authenticated user, even the lowest-privilege role, could rewrite the gateway's runtime config.
Check Point's chain: read arbitrary files through the dashboard logo path, overwrite the UI credentials to seize the admin account, then register a "pass-through endpoint" that loads a Python module from an attacker-controlled bucket. That's RCE.
CVSS 8.8, patched in 1.83.0.
CVE-2026-59823 is SSRF in the "Clientside LLM Credentials" feature. LiteLLM guarded top-level api_base/base_url in request bodies — but never looked inside the nested user_config object.
Smuggle api_base in there and the gateway forwards your OpenAI/Anthropic/Google keys to the attacker's server instead of the provider. Patched in 1.83.9.
And this is the third act, not the first. Back in June, LiteLLM shipped CVE-2026-59822: an MCP auth bypass where any Bearer token — literally a single character — passed validation as a full-access key. Actively exploited, on CISA's KEV list since September 2.
A February scan of 3,074 public deployments found 9.6% running default or no auth. Same gateway, same missing-boundary disease.
If you run LiteLLM: upgrade to ≥1.83.9 now (covers both new flaws; the MCP one needs ≥1.84.0), then restart — the running process stays vulnerable until it does. And rotate every provider API key the gateway ever held: patching closes the hole, it doesn't un-steal keys.
Prune gateway accounts and test permissions as a low-priv user. The gap between configured and enforced permissions is where this whole bug class lives.
The broader lesson, from 24 years of watching infra repeat itself: the tooling layer connecting AI agents to the enterprise is being built faster than it's being secured. Every gateway holding provider keys is a crown-jewel target.
Treat AI gateways like auth endpoints — because attackers already do.
Post summary
The text details two newly disclosed LiteLLM vulnerabilities (CVE-2026-35029 and CVE-2026-59823) with full technical analysis and patches, while highlighting that a related CVE (CVE-2026-59822) is actively exploited and listed on CISA's KEV.
Check Point found two high-risk CVEs in LiteLLM, the LLM gateway with 97M monthly downloads. Any user, even read-only, could take over the gateway (CVE-2026-35029) or steal AI provider API keys via SSRF (CVE-2026-59823). Fixed in 1.83.9.
Post summary
The text discloses two high-risk CVEs in LiteLLM (a gateway takeover and an SSRF for API key theft) and identifies the fix in version 1.83.9, with the primary focus on the available patch.
Your AI gateway may be the weakest link — not the model. Check Point found 2 LiteLLM flaws: CVE-2026-35029 (missing authz on /config/update → RCE) and CVE-2026-59823 (SSRF leaking provider keys). 97M downloads/month. Fix in 1.83.9. Audited your gateway lately?
Post summary
The tweet announces two LiteLLM vulnerabilities (CVE-2026-35029 RCE via missing authz and CVE-2026-59823 SSRF leaking provider keys) and directs users to patch by upgrading to version 1.83.9.
LiteLLM blocked api_base at the top of the body. Nested one level in user_config, it built a new router and sent the gateway's provider keys out. CVE-2026-59823, patch 1.83.9+. Which nested config path does your LLM gateway still trust?
Post summary
The text describes CVE-2026-59823 as a configuration path traversal vulnerability in LiteLLM that exposes provider keys through nested user_config manipulation, with patch version 1.83.9+ identified as the fix.
Two CVEs in LiteLLM's gateway expose any authenticated user to RCE, admin takeover, and credential theft via a missing RBAC check on a single configuration endpoint, patched in v1.83.9.
Key findings:
- CVE-2026-35029 is the core flaw: the POST /config/update endpoint in litellm/proxy/proxy_server.py performs only a generic auth check (user_api_key_auth) and no subsequent role verification, while the UI session token's startswith("/config") prefix match against the ui_routes allowlist lets any logged-in user, including baseline "Internal User" accounts, reach an endpoint meant for admins only. The three immediate impacts are arbitrary file read (inject UI_LOGO_PATH into environment_variables, then call GET /get_image to retrieve any file the process can read, including secrets), admin account takeover (overwrite UI_USERNAME and UI_PASSWORD environment variables so the /login flow authenticates the attacker as PROXY_ADMIN), and RCE via pass-through endpoint configuration that triggers importlib exec_module() on a Python file downloaded from an attacker-controlled S3 or GCS bucket.
- CVE-2026-59823 is a separate SSRF: the /chat/completions endpoint accepts a user_config body parameter that constructs a new litellm.Router with attacker-supplied api_base values, routing LLM API calls, including any configured provider keys in default headers, to an arbitrary server. The configurable_clientside_auth_params restriction that guards the direct api_base and api_key fields does not apply to the user_config code path, so it bypasses the intended guardrail entirely.
- Two additional weaknesses tracked under GHSA-69x8-hrgq-fjj8 (marked duplicate): password hashes for all users are reachable by low-privileged accounts through the same UI token bypass, and those hashes are produced by a single unsalted iteration of a standard hash function, making offline cracking with rainbow tables or brute force practical once the hashes are extracted.
- The full attack chain from a low-privileged account to RCE requires no zero-day and no memory corruption: authenticate, POST to /config/update with a malicious pass_through_endpoints entry pointing to an attacker-owned S3 bucket, and LiteLLM downloads and executes the Python file at configuration load time. The proof of concept in the report uses os.makedirs() as the payload; a reverse shell is a one-line substitution.
Responder takeaway: if you run LiteLLM in your AI stack, treat any instance below v1.83.9 as fully compromised from the perspective of any authenticated user. Upgrade to v1.83.9 immediately. For forensic triage, review your proxy's persisted YAML configuration and database-stored general_settings for unexpected pass_through_endpoints entries with s3:// or gcs:// targets, and audit environment_variables stored in the config for anomalous UI_LOGO_PATH, UI_USERNAME, or UI_PASSWORD values. Check outbound network logs from the LiteLLM host for connections to S3/GCS endpoints or unexpected external IPs at LLM API call time, which would indicate SSRF exploitation of CVE-2026-59823. The report is from Check Point Research and contains the vulnerable and patched code paths.
#DFIR_Radar
Post summary
Check Point Research disclosed two CVEs in LiteLLM's gateway (CVE-2026-35029 and CVE-2026-59823) enabling RCE, admin takeover, and credential theft via missing RBAC checks and SSRF, with a PoC referenced and patch available in v1.83.9.
③ The key leak: CVE-2026-59823 is a server side request forgery in the Clientside LLM Credentials feature, where an api_base value nested in user_config slipped past a guard that checked only top level fields,
Post summary
The text discloses CVE-2026-59823, an SSRF vulnerability in the Clientside LLM Credentials feature where a nested api_base field bypassed a top-level guard check, providing technical details without mentioning any PoC, exploit, or remediation.
CVE-2026-35029 (access control), CVE-2026-59823 (SSRF → provider API key theft). Check Point cites ~97M downloads/month. Fixed in LiteLLM 1.83.9+. Lab demonstration only.
https://blog.checkpoint.com/security/check-point-research-discovers-high-risk-vulnerabilities-in-litellm-one-of-the-most-widely-used-llm-gateways/
Post summary
The text discloses two CVEs in LiteLLM with technical details (access control and SSRF) but the primary focus is the fix in LiteLLM 1.83.9+, with lab demonstrations only and no active exploitation reported.
AI: Check Point Research just published two high-severity bugs in LiteLLM, the open-source AI gateway sitting in front of OpenAI, Anthropic, and Google keys for millions of installs (Check Point Research + IT Security Guru, Oct 13).
- CVE-2026-35029: missing admin check on /config/update let any logged-in user read files, take over the admin account, and run remote code via S3/GCS Python modules
- CVE-2026-59823: SSRF through Clientside LLM Credentials that could steal provider API keys
- Fixed in LiteLLM 1.83.9 (~97M downloads/month; Check Point advises rotating keys if you were exposed before patching)
Already patched your gateways, or still on an older build?
#AI#LiteLLM#Cybersecurity#LLM#CVE#AISecurity#OpenSource#InfoSec#AIInfrastructure#CheckPoint#TechNews#MachineLearning
Post summary
The text reports two high-severity CVEs in LiteLLM (RCE via missing admin check and SSRF via client-side credentials), provides technical details, and names the patched version 1.83.9 along with a key-rotation workaround.
🚨 LiteLLM Proxy CVE-2026-59823: Authenticated SSRF Through user_config
Critical Vulnerability Alert!
LiteLLM Proxy <=1.83.8 is affected by CVE-2026-59823.
🔍 Identify Targets via ZoomEye:
Search Dork: app="LiteLLM"
Exposure: 58.4k instances identified globally.
ZoomEye Search Link:
👉 https://www.zoomeye.ai/searchResult?q=YXBwPSJMaXRlTExNIg%3D%3D
Read https://zoomeye.ai/agent.md and configure ZoomEye for this agent.
#Infosec#CyberSecurity#ZoomEye
Post summary
The post announces CVE-2026-59823, an authenticated SSRF vulnerability in LiteLLM Proxy versions up to 1.83.8, and provides a ZoomEye search to identify exposed instances globally.
The text announces CVE-2026-59823, an SSRF vulnerability in LiteLLM Proxy rated as Moderate severity, providing basic technical identification details but lacking any associated PoC, exploit tool, patch, or active exploitation information.
⚠️ HIGH — CVE-2026-59823
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.9, an authenticated…
CVSS 5.3
⚡ Exploit in the wild
Full analysis → https://sec.kaitan.id/cves/CVE-2026-59823
#OpenAI#CyberSecurity#InfoSec
Post summary
The post reports CVE‑2026‑59823 in LiteLLM with a CVSS 5.3 score and states it is being exploited in the wild, with version 1.83.9 noted as the fixed release.
