Log in Start free

Vulnerability · Published Apr 6, 2026 · Assigned by GitHub_M

CVE-2026-35029LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint

High 8.8

In plain English

A high-severity incorrect authorization in litellm from BerriAI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 38.6% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)38.6%top 1.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling2Nuclei, Public PoC

Official description

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to modify proxy configuration and environment variables, register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution, read arbitrary server files by setting UI_LOGO_PATH and fetching via /get_image, and take over other privileged accounts by overwriting UI_USERNAME and UI_PASSWORD environment variables. Fixed in v1.83.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIlitellm1.83.0GHSA-53mr-6c8q-9789
PyPIlitellm1.83.0PYSEC-2026-2597

Affected products (as reported)

VendorProductVersions
BerriAI litellm < 1.83.0

Weakness: CWE-863, CWE-425 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References