Check Point Research tested LiteLLM v1.77.7, a widely used open-source LLM gateway, and reported two issues now fixed:

• CVE-2026-35029 (GHSA-53mr-6c8q-9789, fixed in 1.83.0): /config/update didn't enforce the admin role, so any authenticated user could modify proxy config and environment variables, read arbitrary files via UI_LOGO_PATH and /get_image, take over admin accounts by overwriting UI_USERNAME/UI_PASSWORD, and register pass-through handlers pointing at attacker Python for RCE.
• CVE-2026-59823 (GHSA-hx8v-g79f-8w5f, fixed in 1.83.9): the request-body guard blocked top-level api_base/base_url but not one nested in user_config, so a caller with a virtual key could redirect the gateway's outbound request, and per Check Point capture the provider API keys it carries.

No in-the-wild exploitation is reported. Do now: run LiteLLM 1.83.9 or later, treat every virtual key as able to reach the gateway's secrets on older versions, rotate provider keys if you ran an affected version with untrusted users, and keep the proxy admin UI off the internet.