LiteLLM users urged to patch flaws that could hand attackers admin control

For organisations sending artificial intelligence requests through LiteLLM, the gateway holds the credentials, configuration and routing decisions that determine where those requests go. The open-source proxy standardises calls to different large language model APIs and is among the most widely used LLM gateways. It acts as a chokepoint for enterprise AI traffic.

Multiple high-impact vulnerabilities were found in versions before 1.83.9, including CVE-2026-35029 and CVE-2026-59823. The flaws could give attackers with authenticated access a way to take administrative control, obtain credentials and redirect API calls.

One weakness lay in the /config/update endpoint. A missing authorisation check meant any authenticated user, including an account with limited privileges, could alter the proxy’s live configuration.

That access could enable arbitrary file reading, takeover of an administrative account and remote code execution through malicious Python modules loaded from cloud storage.

A separate server-side request forgery, or SSRF, flaw affected the feature called ‘Clientside LLM Credentials’. It could allow an attacker to reroute API calls and extract provider keys.

CVE-2026-59823 is also described as server-side request forgery through the user_config request parameter in LiteLLM Proxy. It has a Common Vulnerability Scoring System score of 5.3, rated Medium severity, and was published on 16 September 2026.

The vulnerabilities described in the disclosure have been resolved in LiteLLM version 1.83.9.

LiteLLM began through Y Combinator and offers both a software development kit and a gateway for working with several LLM providers.

The wider record lists 30 CVE vulnerabilities in LiteLLM. Among them, CVE-2026-93355 concerns weak JWT authentication through email-based user lookup, has a score of 8.1 and High severity, and was published on 28 September 2026.

CVE-2026-89032 concerns a tenant-isolation bypass through the semantic cache layer. It affects BerriAI LiteLLM versions below 1.101.0-rc.1, has a score of 7.7 and High severity, and was published on 25 September 2026.

CVE-2026-59822 concerns an MCP authentication bypass through an OAuth2 passthrough fallback. It has a score of 8.8 and High severity, and was published on 8 July 2026.

Other published vulnerabilities include CVE-2026-84377, involving authenticated SSRF and provider-credential extraction through unvalidated request-body routing parameters. It has a score of 6.5 and Medium severity, and was published on 2 September 2026.

CVE-2026-108575 concerns improper authorisation in BerriAI LiteLLM Secret Resolution’s main.py get_secret. It has a score of 6.3 and Medium severity, and was published on 11 October 2026.

CVE-2026-108574 concerns authorisation in BerriAI LiteLLM Spend Tracking’s spend_management_endpoints.py ui_view_session_spend_logs. It has a score of 4.3 and Medium severity, and was also published on 11 October 2026.