Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Yes. Check Point Research says LiteLLM deployments earlier than 1.83.9 are exposed to two high-risk vulnerabilities: CVE-2026-35029, which can let a low-privilege authenticated user reach administrative functions, and CVE-2026-59823, which can redirect gateway traffic to capture provider API keys. Upgrade every affected deployment to LiteLLM 1.83.9 or later, then review access and rotate keys if exposure is possible.
Why a LiteLLM compromise matters
LiteLLM is an open-source gateway between applications and large-language-model providers including OpenAI, Google and Anthropic. It routes prompts and responses, stores provider credentials and records usage. A compromise therefore reaches beyond the gateway itself: an attacker may obtain keys that can be used directly against provider accounts, alter routing, read files or increase cloud spending.
As an Amazon Associate I earn from qualifying purchases.
Check Point Research reported 97 million LiteLLM downloads per month and more than 59,000 GitHub stars at publication in 2026. Its controlled demonstration achieved full system takeover, file access, credential theft and remote code execution. Those results describe the tested impact, not a claim that every deployment has already been breached.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteThe two title-specific vulnerabilities
| CVE | Attack class | What the attacker can do | Version guidance |
|---|---|---|---|
| CVE-2026-35029 | Authorization and privilege escalation | Reach administrative functions, modify proxy configuration and environment variables, read arbitrary server files, overwrite administrator credentials, register custom endpoint handlers pointing to attacker-controlled Python code, and direct the gateway to download and execute external code. | Check Point’s combined guidance treats versions earlier than 1.83.9 as exposed. Its CVE advisory describes LiteLLM before 1.83.0 as affected. |
| CVE-2026-59823 | Server-side request forgery (SSRF) | Supply a malicious destination so the gateway creates a route to an attacker-controlled server. Requests sent through that route can contain the provider API keys used by LiteLLM. | Upgrade to 1.83.9 or later, the release Check Point identifies as fixing both title-specific flaws. |
Both issues required a valid proxy API key, according to LiteLLM’s security statement; they were not described as unauthenticated attacks. That still leaves any account able to obtain or use a key as a potential entry point, especially where roles are broadly assigned or keys are embedded in internal applications.
#1 Best Overall
What changed in the fixes
LiteLLM’s April 3, 2026 security update says the /config/update endpoint did not check the caller’s role. The fix requires the proxy_admin role before that endpoint can be used. The vendor says the earlier behavior could lead to arbitrary file read, administrator account takeover or remote code execution.
That vendor note records the endpoint fix in version 1.83.0. Because Check Point’s report covers the two flaws together and identifies 1.83.9 as the combined fixed release, 1.83.9 or newer is the practical minimum for organizations addressing this incident. Do not treat a deployment at 1.83.0–1.83.8 as fully remediated for the title-specific findings.
How to determine whether your gateway is vulnerable
- Find every deployment. Inventory standalone proxies and LiteLLM instances embedded in internal tools, application platforms, notebooks or automation services. Check Point specifically warns that embedded copies can be overlooked.
- Record the running release. Inspect the installed package metadata, container image tag or deployment lock file for each instance, and compare it with 1.83.9. Check the running image as well as source-control files; a patched repository does not prove that the live process was restarted.
- Identify reachable accounts and keys. List users, service accounts and proxy API keys that can call the gateway. Remove unused credentials and narrow roles before testing so the review does not expand access.
- Test effective permissions. In a controlled, authorized assessment, verify that a non-administrator cannot invoke administrative configuration routes, particularly
/config/update, and cannot create or use keys that reach routes outside the account’s assigned permissions. A user’s effective permission matters more than the role label shown in an identity system. - Check for SSRF indicators. Review gateway and network logs for newly created routes, requests to destinations that are not approved providers, unusual outbound connections, or responses containing credential material. Preserve timestamps and request identities before rotating evidence away.
- Escalate suspected exposure. If an unauthorized user could reach administrative functions or redirect a request, treat provider credentials as compromised even if you cannot prove that a key was copied.
Remediation checklist
- Upgrade every affected instance to LiteLLM 1.83.9 or later and restart the running service.
- Review all accounts and remove unnecessary access. Pay particular attention to users who can obtain proxy API keys or invoke configuration endpoints.
- Rotate OpenAI, Anthropic, Google and other provider keys when unauthorized access is possible. Revoke old keys where the provider supports revocation, then update secrets in every dependent service.
- Examine provider billing, usage and gateway logs for unexpected models, destinations, request volume or spend after the suspected exposure window.
- Include the gateway, its identity integration and outbound network paths in routine penetration tests and vulnerability assessments.
- After patching, repeat the effective-permission tests and confirm that administrative routes reject lower-privilege accounts.
- Organizations using Check Point gateways can review the advisory’s relevant IPS protections, enable the applicable protections and install policy as directed by that advisory.
Related LiteLLM privilege findings
Check Point separately published advisories for CVE-2026-47101 and CVE-2026-47102 on June 22, 2026. Those findings concern LiteLLM before 1.83.14 and describe an authenticated internal_user creating API keys with routes outside that user’s permissions, then using them to reach administrator-only routes and escalate to proxy_admin. They are separate from CVE-2026-35029 and CVE-2026-59823, but they show why key-generation paths and effective permissions should be tested during the same review.
Operational safeguards after upgrading
Separate gateway credentials from provider credentials
Keep provider keys in a secret manager and restrict which gateway processes can read them. Avoid placing long-lived provider keys in source code, client-side applications or broad environment scopes. Rotation is faster and safer when each provider, environment and team has its own credential.
Rank #3
Constrain outbound access
Allow the gateway to contact only required provider endpoints and approved internal services. Egress controls cannot replace patching, but they can limit an SSRF route’s ability to reach arbitrary destinations.
Make administrative actions observable
Retain audit records for configuration changes, key creation, role changes, route creation and unusual outbound requests. Alert on changes made outside the normal deployment process and on sudden provider spend increases.
Use independent review
LiteLLM says it engaged Veria Labs to audit the proxy and launched a bug-bounty program. Independent testing should still cover the exact deployment, identity configuration and network controls used by your organization; a general product audit does not certify every deployment configuration.
Free tools Windows power users keep installed
One-click scans. No signup required.
Bottom line for LiteLLM operators
Assume a LiteLLM release earlier than 1.83.9 is vulnerable to the two reported flaws. Patch first, then verify that low-privilege accounts cannot reach configuration or unauthorized key-generation paths. If there is any credible sign of misuse, rotate every provider key accessible to the gateway, investigate logs and billing, and keep the affected instance under incident-response controls until those checks are complete.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
