Two LiteLLM flaws let a basic user account take over the gateway or capture AI provider keys
Check Point Research disclosed two LiteLLM flaws, CVE-2026-35029 and CVE-2026-59823, both fixed in version 1.83.9. On older versions a basic account is enough to take over the gateway or capture provider API keys, according to Check Point's testing.
The Watch · Security desk
LiteLLM has 97 million downloads per month and over 59,000 GitHub stars, both figures disputed. Check Point Research discovered two high-risk vulnerabilities in it, tracked as CVE-2026-35029 and CVE-2026-59823.
| Figure | Value | Note | Claim |
|---|---|---|---|
| LiteLLM downloads per month | 97,000,000 downloads | disputed | 16 |
| LiteLLM GitHub stars, over | 59,000 GitHub stars | disputed | 16 |
| High-risk vulnerabilities Check Point Research found | 2 vulnerabilities | CVE-2026–35029 and CVE-2026–59823 | 1 |
What happened
- CVE-2026-59823 let a gateway user supply a malicious destination, and LiteLLM built an unvalidated route to the attacker's server carrying the provider API keys.
- Check Point says it demonstrated full system takeover, credential theft and remote code execution in a controlled test environment.
- LiteLLM draws 97 million downloads a month and has more than 59,000 GitHub stars.
Why it matters
- Who's exposed exposure Every holder of a login on a gateway below 1.83.9 is a possible route to admin, read-only users included, so the account list sets the size of the exposure.
- What it costs cost The organization that owns a captured provider key pays for whatever is run on it, and Check Point lists unexpected billing among the impacts.
- Who's exposed exposure Teams that never installed LiteLLM themselves may still run it inside a platform or internal tool, where a check of their own deployments will not find it.
- Who has to decide decision Upgrading closes the path, but a provider key that already left the gateway still works without further authentication, so rotation is a separate call.
Next story · Security · 3h ago
Public exploit takes root on OpenBSD 7.9 through a bug that shipped as a reliability fixConfirmed2 publishers
CVE-2026-35029 is a permissions failure. LiteLLM uses role based access control: administrators run the system, and everyone else gets limited or read only access [4]. The flaw let minimal-privilege users reach the administrative functions that control the gateway's core configuration [4].
From there Check Point lists three moves. An attacker could read files on the server, including configuration and system files. They could overwrite administrator credentials with their own and lock the real administrators out. And they could instruct the gateway to download and execute code from an external source [5]. That last step is the route to malware installation, data exfiltration or movement to other systems on the network [6].
CVE-2026-59823 works at the request level. A gateway user supplies a malicious destination inside a request, and LiteLLM creates a new route to the attacker's server without validating it [13]. The redirected requests carry the keys LiteLLM uses to authenticate with AI providers [13]. The gateway stores keys for every provider the organization uses, so it is a concentrated target [11]. Check Point says the theft needs no compromise of OpenAI, Anthropic or any other provider [14].
We think CVE-2026-35029 is the larger exposure. It ends in code execution on the gateway host [5]. CVE-2026-59823 ends at credentials [13]. Both start from an ordinary account, so neither is easier to reach than the other [10].
All of this comes from Check Point, which found the flaws and ran the demonstrations. Its post does not report exploitation in the wild, name a threat actor, or include severity scores and disclosure dates. Check Point says it responsibly disclosed both issues to LiteLLM [9].
What to watch
- Whether Check Point or LiteLLM publish severity scores, disclosure dates, or any report of exploitation in the wild.
- Whether the platforms and internal tools that embed LiteLLM ship their own fixed builds.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption70
- Hype gap+15
- Incentives50
- Confidence65
Perspective Coverage
3 publishers- Builder
- Builder 32%
- Operator
- Operator 51%
- Investor
- Investor 17%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Check Point Research discovered two high risk vulnerabilities in LiteLLM, tracked as CVE-2026-35029 and CVE-2026-59823.
- [2]
Both vulnerabilities are fixed in LiteLLM version 1.83.9 and above, and organizations running earlier versions are exposed to both and should update immediately, according to Check Point.
- [3]
CVE-2026-35029 allowed any user, including those with read only access, to reach administrative functions and take over the gateway.
- [4]
CVE-2026-35029 is an access control vulnerability in how LiteLLM enforces permissions; LiteLLM uses role based access control where administrators manage the system and other users receive limited or read only access, and users with minimal privileges could reach administrative functions controlling the gateway's core configuration.
- [5]
From administrative access an attacker could read files stored on the server, including configuration files and system files containing sensitive information; overwrite administrator credentials with their own, locking legitimate administrators out; and instruct the gateway to download and execute code from an external source.
- [6]
Downloading and executing external code could enable malware installation, data exfiltration or movement to other systems on the network.
- [7]
Check Point Research demonstrated full system takeover, file access, credential theft, and remote code execution in a controlled test environment.
- [8]
The credentials a gateway holds provide direct, billable access to AI providers with no further authentication required.
- [9]
Check Point responsibly disclosed both issues to LiteLLM.
- [10]
Individually, each of the two vulnerabilities gave an attacker with a basic user account a path to the most sensitive assets in an organization's AI stack.
- [11]
LiteLLM functions as an LLM gateway through which every request from an organization's applications travels to an AI provider, and it stores API keys for every AI provider the organization uses.
- [12]
CVE-2026-59823 is a server side request forgery (SSRF) flaw that allowed any gateway user to direct LiteLLM to send API requests to a server under the attacker's control.
- [13]
By supplying a malicious destination within a request, the attacker caused the gateway to create a new route to their own server without validating it, and the redirected requests carried the API keys LiteLLM uses to authenticate with AI providers.
- [14]
The impact of CVE-2026-59823 includes theft of AI provider API keys without any compromise of OpenAI, Anthropic or other providers, unauthorized use of the organization's AI provider accounts, and unexpected costs billed to the organization.
- [15]
LiteLLM is embedded in many platforms and internal tools used to build AI applications, and security teams should check for LiteLLM running indirectly.
- [16]
LiteLLM has 97 million downloads per month and over 59,000 GitHub stars.
Sources
3 independent publishers whose own reporting we read for this story.
- blog.checkpoint.comCheck Point Research Discovers High Risk Vulnerabilities in LiteLLM, One of the Most Widely Used LLM Gateways
1 article · October 13, 2026
- infosecurity-magazine.comWarning Over High-Risk Vulnerabilities in Widely Used LLM Gateway Tool
1 article · October 15, 2026
- itpro.comLiteLLM flaws allow full admin control and API-key theft
1 article · October 15, 2026
Topics and entities
Topics
- Vulnerability Disclosure
- API key security
- AI Gateway and LLM Key Security