Check Point Research disclosed two critical vulnerabilities in LiteLLM, the open-source AI gateway, on October 14. One allows a low-privilege user to take over administrator settings and run code, and the other lets attackers capture OpenAI, Anthropic and Google API keys.
CVE-2026-35029: Missing Authorization on the /config/update Endpoint
CVE-2026-35029 is a missing authorization flaw on the /config/update endpoint. A low-privilege user, even one with read-only access, can change administrator-only settings. Check Point says the flaw also lets that user read server files, overwrite administrator credentials and execute code on the server.
From Read-Only Account to Server Control
The chain of consequences makes the flaw more serious than its description suggests. Changing admin-only settings opens the way to reading files and overwriting administrator credentials, and those capabilities together lead to code execution. A user who holds the most limited role in the gateway therefore has a path to full control of the host.
CVE-2026-59823: SSRF in the Clientside LLM Credentials Feature
CVE-2026-59823 is a server-side request forgery in the “Clientside LLM Credentials” feature. Attackers can redirect the gateway’s requests to a server of their own and capture the API keys the gateway sends along. Check Point says the keys exposed include those for OpenAI, Anthropic and Google.
A gateway of this kind holds credentials for several model providers in one place. A flaw that redirects its outbound requests therefore exposes the keys for every provider the gateway is configured to call.
Costly API Abuse and Data Access
Stolen provider keys can enable costly API abuse and access to data tied to the accounts behind them. The sources do not report any in-the-wild exploitation of either flaw, and they do not say that any keys have been stolen.
About 100 Million Downloads a Month and Hidden Deployments
LiteLLM records about 97 to 100 million downloads a month. Check Point tested version 1.77.7. The gateway is embedded in many AI platforms, so organizations may be running it without knowing, as a component underneath another product. An organization that never installed LiteLLM directly could still be exposed through a platform that includes it.
A Separate Set of CVEs From Earlier LiteLLM Issues
These are different vulnerabilities from LiteLLM issues covered in coverage earlier this month. The earlier problems do not overlap with CVE-2026-35029 or CVE-2026-59823, so patching for the earlier flaws does not address the new ones.
No Fixed Version Named in the Sources
Defenders are advised to upgrade LiteLLM to a patched version and review their exposure. The sources do not name the fixed version, so administrators need to consult the LiteLLM project or Check Point’s report for the release that contains the fixes.
LiteLLM as a Central Store of Model Provider Keys
AI gateways concentrate access. One service sits between applications and several model providers, holds the keys to each and often runs with permissions to reach internal systems. The two flaws affect different parts of that role: CVE-2026-35029 targets control of the gateway itself, and CVE-2026-59823 targets the credentials it holds.
The scale of the project’s downloads means the fixes have to reach a large and mostly invisible user base. Because LiteLLM is embedded in other platforms, vendors that ship it as a component will need to release their own updates before their customers are protected. The sources do not say which platforms include the affected versions.
Check Point’s testing was done on one version, 1.77.7. The sources do not specify which other versions are affected or when the flaws were introduced, which leaves the full range of vulnerable releases unconfirmed in the available reporting.
