BerriAI · litellm
LiteLLM, an LLM API proxy server (AI Gateway) from BerriAI, contains an authorization flaw in its /config/update endpoint, which does not enforce admin role checks. An attacker with network access to the proxy and an existing authenticated low-privilege account can use this endpoint, without user interaction, to modify configuration and environment variables, enabling remote code execution, arbitrary server file reads, and takeover of privileged accounts.
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to modify proxy configuration and environment variables, register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution, read arbitrary server files by setting UI_LOGO_PATH and fetching via /get_image, and take over other privileged accounts by overwriting UI_USERNAME and UI_PASSWORD environment variables. Fixed in v1.83.0.
First seen exploited the day it was disclosed. Public exploit code (PoC-in-GitHub) appeared 43 days after disclosure.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: litellm.
Upgrade to 1.84.0 or later
Fixes this CVE and 6 other known vulnerabilities in this package (CVE-2024-6587, CVE-2026-40217, +4).
pip install "litellm>=1.84.0"First fixed in 1.83.0 for CVE-2026-35029.
| If you run | Upgrade to |
|---|---|
| All versions before 1.83.0 | 1.84.0first fix for this CVE: 1.83.0 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.