LiteLLM 1.83.9 fixes two vulnerabilities in its LLM gateway

A team did a test of LiteLLM version 1.77.7, an open-source LLM gateway, for vulnerabilities. The vulnerabilities have the names CVE-2026-35029 and CVE-2026-59823. One missing role check let each user with an account change the configuration of the proxy. An attacker can then read files, get control of an administrator account and start code. Version 1.83.9 fixes the vulnerabilities.

What a gateway does

An LLM gateway is between software and one or more model providers. It frequently holds credentials, configuration and routing data.

The main vulnerability

The endpoint POST /config/update has no role check. Its path starts with /config, and the allowlist for sessions in the user interface gives access to each path with that start. Because of this, each user with a session token can change the configuration.

What an attacker can do

• Read each file that the LiteLLM software can get.
• Get control of an administrator account.
• Start Python modules that an attacker puts in cloud storage.

To read files, the attacker sets UI_LOGO_PATH through the endpoint. The /get_image endpoint then gives the file at that path without a check.

A second vulnerability

The Clientside LLM Credentials function has an SSRF (server-side request forgery) vulnerability. It lets attackers send API calls to a different position and get provider keys.