{"id":"CVE-2026-35029","published":"2026-04-06T16:35:28Z","modified":"2026-07-15T01:03:19Z","title":"LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint","vendor":"BerriAI","product":"litellm","tier":"core","eol":null,"affectedVersions":[{"vendor":"BerriAI","product":"litellm","versions":["< 1.83.0"]}],"description":{"text":"LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to modify proxy configuration and environment variables, register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution, read arbitrary server files by setting UI_LOGO_PATH and fetching via /get_image, and take over other privileged accounts by overwriting UI_USERNAME and UI_PASSWORD environment variables. Fixed in v1.83.0.","provenance":"source","from":"CVE.org"},"summary":{"text":"LiteLLM, an LLM API proxy server (AI Gateway) from BerriAI, contains an authorization flaw in its /config/update endpoint, which does not enforce admin role checks. An attacker with network access to the proxy and an existing authenticated low-privilege account can use this endpoint, without user interaction, to modify configuration and environment variables, enabling remote code execution, arbitrary server file reads, and takeover of privileged accounts.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:44:17Z"},"cvss":{"score":8.7,"severity":"HIGH","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.38613,"percentile":0.98577,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-04-06","exploitedFirstSeen":"2026-04-06","ransomware":false,"evidence":[{"url":"https://labs.zenity.io/post/admin-api-escalation-litellm","date":"2026-04-06"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":17,"pulses":[{"name":"Known_Cve | Apr 24, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69ea3f5ba5d3a028c6ef7ecf","created":"2026-04-23"},{"name":"Known_Cve | Apr 23, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e8ec53d8e9285aa573199c","created":"2026-04-22"},{"name":"Known_Cve | Apr 22, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e79c01c3d8244296d32902","created":"2026-04-21"},{"name":"Known_Cve | Apr 21, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e64ae4502f00a0cc9986e5","created":"2026-04-20"},{"name":"Known_Cve | Apr 20, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e4f971582b6761602eb4a2","created":"2026-04-19"},{"name":"Known_Cve | Apr 19, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e3a7638300f0eb1346a035","created":"2026-04-18"},{"name":"Known_Cve | Apr 18, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e25442402a04b23b8aa1a2","created":"2026-04-17"},{"name":"Known_Cve | Apr 17, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e103976603776b725a4a5a","created":"2026-04-16"},{"name":"Known_Cve | Apr 15, 2026","url":"https://otx.alienvault.com/pulse/69de5f919b88b9566b77d9fa","created":"2026-04-14"},{"name":"Known_Cve | Apr 14, 2026","url":"https://otx.alienvault.com/pulse/69dd7235cc14d6e4d874a258","created":"2026-04-13"}],"provenance":"machine"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"},{"id":"CWE-425","name":"Direct Request"}],"references":[{"url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-53mr-6c8q-9789","tags":["x_refsource_CONFIRM"]},{"url":"http://seclists.org/fulldisclosure/2026/Apr/17","tags":[]},{"url":"https://access.redhat.com/security/cve/CVE-2026-35029","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455474","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35029.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13545","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28960","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:30056","tags":["vendor-advisory","x_refsource_REDHAT"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"PyPI","package":"litellm","vulnerableRanges":["<1.83.0"],"patched":["1.83.0"],"from":["GHSA-53mr-6c8q-9789","PYSEC-2026-2597"],"provenance":"source"}],"advisories":[{"id":"GHSA-53mr-6c8q-9789","url":"https://github.com/advisories/GHSA-53mr-6c8q-9789","severity":"HIGH","ecosystem":"PyPI","package":"litellm","vulnerableRanges":["<1.83.0"],"patched":["1.83.0"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2026-19370","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-19370","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-05-19","earliestUrl":"https://github.com/learner202649/CVE-2026-35029-PoC","repos":[{"name":"learner202649/CVE-2026-35029-PoC","url":"https://github.com/learner202649/CVE-2026-35029-PoC","stars":0,"created":"2026-05-19"}]},"nuclei":[{"id":"CVE-2026-35029","name":"LiteLLM - Arbitrary File Read","severity":"high","path":"http/cves/2026/CVE-2026-35029.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-35029.yaml"}],"first":{"date":"2026-05-19","source":"PoC-in-GitHub","url":"https://github.com/learner202649/CVE-2026-35029-PoC"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-04-06","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-35029","provenance":"source"},{"date":"2026-04-06","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://labs.zenity.io/post/admin-api-escalation-litellm","provenance":"source"},{"date":"2026-05-19","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/learner202649/CVE-2026-35029-PoC","provenance":"source"}],"speed":{"daysToPublicExploit":43,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":73.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 208 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.72,"detail":"percentile 0.9858"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":2.85,"detail":"17 pulses"},{"name":"CVSS severity","points":6.09,"detail":"base score 8.7"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}