CVE-2026-35029
HighCVSS 8.8Exploitation Probability (EPSS)
Very high risk98th percentile - higher than 98% of all known CVEs
Summary
LiteLLM before version 1.83.0 has a vulnerability where the /config/update endpoint does not enforce admin role authorization. An authenticated user can modify proxy configuration, environment variables, and register custom pass-through endpoint handlers, leading to remote code execution, arbitrary file reading, and takeover of privileged accounts.
Risk Assessment
The organization risks complete compromise of the LiteLLM server, data leakage, and unauthorized access to AI models, potentially resulting in system integrity breaches and loss of customer trust.
Recommendation
Immediately upgrade LiteLLM to version 1.83.0 or later. Restrict access to the /config/update endpoint to trusted administrators and implement additional authorization controls.
Original NVD description (English source)
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to modify proxy configuration and environment variables, register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution, read arbitrary server files by setting UI_LOGO_PATH and fetching via /get_image, and take over other privileged accounts by overwriting UI_USERNAME and UI_PASSWORD environment variables. Fixed in v1.83.0.