---
title: Check Point: any low-privilege LiteLLM user could take over the gateway (CVE-2026-35029) or steal provider API keys via SSRF (CVE-2026-59823); upgrade to 1.83.9+ | ctxsec
url: https://ctxsec.com/items/checkpoint-litellm-config-update-takeover-ssrf
description: "Check Point Research found that LiteLLM's /config/update endpoint lacked an admin check, letting any authenticated user change runtime config, read server files, overwrite admin credentials and load attacker Python for RCE (fixed in 1.83.0). A second bug let users smuggle api_base inside user_config to redirect requests and capture provider keys (fixed in 1.83.9)."
status: "confirmed (Check Point Research; GitHub advisories); fixed in LiteLLM 1.83.9"
published: 2026-10-13
---

> Check Point Research found that LiteLLM's /config/update endpoint lacked an admin check, letting any authenticated user change runtime config, read server files, overwrite admin credentials and load attacker Python for RCE (fixed in 1.83.0). A second bug let users smuggle api_base inside user_config to redirect requests and capture provider keys (fixed in 1.83.9).

[← AI](/ai) · [markdown](/items/checkpoint-litellm-config-update-takeover-ssrf.md)

confirmed (Check Point Research; GitHub advisories); fixed in LiteLLM 1.83.9

2026-10-13

### Check Point: any low-privilege LiteLLM user could take over the gateway (CVE-2026-35029) or steal provider API keys via SSRF (CVE-2026-59823); upgrade to 1.83.9+

[Check Point Research](https://research.checkpoint.com/2026/when-llm-gateways-go-wrong-findings-from-litellm/) tested LiteLLM v1.77.7, a widely used open-source LLM gateway, and reported two issues now fixed:

- **CVE-2026-35029** ([GHSA-53mr-6c8q-9789](https://github.com/advisories/GHSA-53mr-6c8q-9789), fixed in 1.83.0): `/config/update` didn't enforce the admin role, so any authenticated user could modify proxy config and environment variables, read arbitrary files via `UI_LOGO_PATH` and `/get_image`, take over admin accounts by overwriting `UI_USERNAME`/`UI_PASSWORD`, and register pass-through handlers pointing at attacker Python for RCE.
- **CVE-2026-59823** ([GHSA-hx8v-g79f-8w5f](https://github.com/BerriAI/litellm/security/advisories/GHSA-hx8v-g79f-8w5f), fixed in 1.83.9): the request-body guard blocked top-level `api_base`/`base_url` but not one nested in `user_config`, so a caller with a virtual key could redirect the gateway's outbound request, and per Check Point capture the provider API keys it carries.

No in-the-wild exploitation is reported. **Do now:** run LiteLLM 1.83.9 or later, treat every virtual key as able to reach the gateway's secrets on older versions, rotate provider keys if you ran an affected version with untrusted users, and keep the proxy admin UI off the internet.

Sources: [Check Point Research: When LLM Gateways Go Wrong](https://research.checkpoint.com/2026/when-llm-gateways-go-wrong-findings-from-litellm/) · [GHSA-53mr-6c8q-9789 (CVE-2026-35029)](https://github.com/advisories/GHSA-53mr-6c8q-9789) · [GHSA-hx8v-g79f-8w5f (CVE-2026-59823)](https://github.com/BerriAI/litellm/security/advisories/GHSA-hx8v-g79f-8w5f)