TL;DR; Our security assessment of LiteLLM (v1.77.7), a widely used open-source LLM gateway, uncovered multiple high-impact vulnerabilities (tracked as CVE-2026-35029, CVE-2026-59823) which have been resolved as of LiteLLM version 1.83.9. The most significant issues stemmed from a missing authorization check on the /config/update endpoint, which allowed any authenticated user (including low-privileged accounts) to modify the proxy’s runtime configuration.
When LLM Gateways Go Wrong: Findings from LiteLLM
About this summary. This is a short excerpt from the description that Check Point Research published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://research.checkpoint.com/2026/when-llm-gateways-go-wrong-findings-from-litellm/
Source attribution: headline and facts are from Check Point Research (research.checkpoint.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
LiteLLM Hijacked Again: Malicious 1.107.0 Wheels Steal Credentials and Load Remote Code
The JFrog Security Research team identified malicious code in `litellm` 1.107.0, a widely used Python interface and proxy for large language model providers. The payload…
Warning Over High-Risk Vulnerabilities in Widely Used LLM Gateway Tool
CVE-2026-35029 and CVE-2026-59823 affect LiteLLM, which is commonly used by enterprises to connect their AI applications to providers like OpenAI and Anthropic
Hello Python 3.15, goodbye 3.10, and now I can use 3.11
Python 3.15 is here! Here's the essential What's new in Python 3.15 guide, this year curated by 3.14 and 3.15 release manager Hugo van Kemenade. As someone who builds…
Vulnerability Discovery and Exploitation Trends in the AI Era
Written by: Robin Grunewald, Supriya Mazumdar, Kelli Vanderlee Introduction Google Threat Intelligence Group (GTIG) examines vulnerability disclosure and exploitation…
AL26-027 - Critical vulnerability impacting Google Brotli – CVE-2026-111497
Number: AL26-027 Date: October 28, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently…
n0n Ransomware: Inside an AI-Assisted Extortion Operation
In September 2026, the SOCRadar Threat Research Unit (STRU) discovered an exposed staging server holding the live workspace of an operator tied to the n0n ransomware…