Check Point Research Discovers High Risk Vulnerabilities in LiteLLM, One of the Most ...

Check Point Research has discovered two high risk vulnerabilities in LiteLLM, the open source LLM gateway that organizations use to connect their applications to AI providers such as OpenAI, Google and Anthropic. With 97 million downloads per month and over 59,000 GitHub stars, LiteLLM runs inside large enterprises, startups and many of the platforms used to build AI applications .

Check Point Research discovered two high risk vulnerabilities in LiteLLM, tracked as CVE-2026-35029 and CVE-2026-59823 .

CVE-2026-35029 allowed any user, including those with read only access, to reach administrative functions and take over the gateway.

CVE-2026-59823 allowed attackers to redirect gateway requests to their own server and capture AI provider API keys.

Check Point Research demonstrated full system takeover, file access, credential theft, and remote code execution in a controlled test environment.

Both vulnerabilities are fixed in LiteLLM version 1.83.9 and above, and organizations running earlier versions should update immediately.

What Did Check Point Research Discover in LiteLLM?

Check Point Research identified two separate vulnerabilities in LiteLLM that, individually, gave an attacker with a basic user account a path to the most sensitive assets in an organization’s AI stack.

CVE-2026-35029 , an access control flaw that let low privileged users perform administrative actions, leading to full system takeover

CVE-2026-59823 , a server side request forgery (SSRF) flaw that let users redirect the gateway’s outbound requests, exposing AI provider API keys

In practical terms, anyone holding an account on a vulnerable LiteLLM deployment could take over the gateway and use it for malicious purposes. Check Point responsibly disclosed both issues to LiteLLM, and they are resolved in LiteLLM version 1.83.9 and above.

Why Is a Vulnerability in LiteLLM So Significant?

LiteLLM functions as an LLM gateway, the layer through which every request from an organization’s applications travels on its way to an AI provider. That position gives it responsibility for:

Storing API keys for every AI provider the organization uses

Managing user access through roles and permissions

Routing prompts and responses between applications and providers

Tracking usage and costs across models

The credentials a gateway holds provide direct, billable access to AI providers with no further authentication required. Given LiteLLM’s scale of adoption, a flaw in this component has the potential to affect a very large number of AI deployments at once.

What Is CVE-2026-35029?

CVE-2026-35029 is an access control vulnerability in how LiteLLM enforces permissions. LiteLLM uses role based access control, where administrators manage the system and other users receive limited or read only access. Because of the flaw, users with minimal privileges could reach administrative functions controlling the gateway’s core configuration. From there, an attacker could:

Read files stored on the server, including configuration files and system files containing sensitive information

Overwrite administrator credentials with their own, locking legitimate administrators out of the system

Instruct the gateway to download and execute code from an external source, enabling malware installation, data exfiltration or movement to other systems on the network

Check Point Research demonstrated each of these outcomes in a controlled test environment.

What Is CVE-2026-59823?

CVE-2026-59823 is a server side request forgery vulnerability that allowed any gateway user to direct LiteLLM to send API requests to a server under the attacker’s control. By supplying a malicious destination within a request, the attacker caused the gateway to create a new route to their own server without validating it. The redirected requests carried the API keys LiteLLM uses to authenticate with AI providers, delivering those credentials straight to the attacker. The impact for affected organizations includes:

Theft of AI provider API keys without any compromise of OpenAI, Anthropic or other providers

Unauthorized use of the organization’s AI provider accounts

Unexpected costs billed to the organization

Is My Organization Affected?

Organizations running LiteLLM versions earlier than 1.83.9 are exposed to both vulnerabilities. Security teams should also check for LiteLLM running indirectly, since it is embedded in many platforms and internal tools used to build AI applications and may be present in environments where it was never deployed as a standalone product.

Has LiteLLM Released a Fix?

Yes. Check Point reported both vulnerabilities to LiteLLM through a coordinated disclosure process that began in October 2025. LiteLLM resolved CVE-2026-35029 and CVE-2026-59823 in version 1.83.9, and all later versions include the fixes.

What Should LiteLLM Users Do Now?

Update to LiteLLM 1.83.9 or above as a priority across every environment where the gateway runs.

Review who has access to your gateway . Since any account could be used to exploit these flaws, audit user accounts and remove those that are no longer needed.

Rotate AI provider API keys stored in LiteLLM if there is any indication the gateway was accessed by unauthorized users before patching.

Verify permissions in practice . Confirm that users with limited roles are actually limited, because the gap between configured and enforced permissions is where flaws like CVE-2026-35029 cause the most damage.

Include LLM gateways in security assessments by extending penetration tests and vulnerability assessments to cover AI tooling alongside web applications and cloud infrastructure.

What Does This Disclosure Mean for AI Infrastructure Security?

Both vulnerabilities belong to well understood classes of security error, which shows that AI infrastructure is now exposed to the same risks that enterprise software has faced for years. As tools like LiteLLM gain adoption at speed, attackers are paying close attention to them, and organizations need to secure their AI gateways with the same rigor they apply to any other business critical system.

To read the full technical findings, access the Check Point Research publication here .