LiteLLM Vulnerabilities Could Let Attackers Take Over AI Gateway and Steal API Keys

LiteLLM connects applications to large language models from different providers, including OpenAI and Anthropic, through a single interface. Users can route requests, manage API keys, control user access, and monitor usage and costs. TechRadar reported that LiteLLM supports about 140 AI providers and has more than 90 million monthly downloads on GitHub and more than 61,000 stars.

The first flaw, tracked as CVE-2026-35029, is an access control bug in the way LiteLLM enforces permissions and was given a severity score of 8.7 out of 10, or high. According to Check Point Research, the bug allows users with minimal privileges to reach admin functions that control the gateway's core configuration. From there, they could read files stored on the server, overwrite admin credentials, download and run malware, and carry out other actions.

The second flaw, CVE-2026-59823, is a server-side request forgery bug with a severity score of 5.3 out of 10, or medium. It allows gateway users to direct LiteLLM to send API requests to third-party servers. Because those requests carry AI provider authentication keys, threat actors could send them to servers under their own control and receive the credentials directly. They could then use the credentials to access other organizations' AI accounts and run up their bills.

Check Point Research said the credentials held by a gateway provide direct, billable access to AI providers with no further authentication required. "Given LiteLLM's scale of adoption, a flaw in this component has the potential to affect a very large number of AI deployments at once," the researchers explained.

According to Check Point Research, all organizations running LiteLLM versions earlier than 1.83.9 are exposed to both vulnerabilities. Security teams should also check for LiteLLM instances running indirectly, because the gateway is embedded in many platforms and internal tools used to build AI applications and may be present in environments where it was never deployed as a standalone solution.

LiteLLM version 1.83.9 includes fixes for both bugs, and users are advised to install it as soon as possible. Check Point Research also advised organizations to review who has access to the gateway, because any account could be used to exploit the flaws. AI provider API keys stored in LiteLLM should be rotated if there is any indication that the gateway was accessed by unauthorized users, and permissions should be verified in practice.

"Confirm that users with limited roles are actually limited, because the gap between configured and enforced permissions is where flaws like CVE-2026-35029 cause the most damage," Check Point Research warned. The researchers also said organizations should include LLM gateways in security assessments by extending penetration tests and vulnerability assessments to cover AI tooling alongside web applications and cloud infrastructure.

The researchers said both bugs belong to a well-understood class of errors, meaning AI infrastructure faces the same risks as enterprise software. Organizations should approach AI gateway security with the same rigor they apply to any other business-critical system, they said.

Editor's Summary

Check Point Research found two LiteLLM vulnerabilities: a high-severity access control flaw that can grant admin-level capabilities and a medium-severity SSRF bug that can expose AI provider API keys. LiteLLM version 1.83.9 fixes both issues, and organizations should upgrade, review access, and rotate exposed credentials. The findings show that AI gateways carry enterprise-grade security risks as adoption grows.