"In practical terms, anyone holding an account on a vulnerable LiteLLM deployment could take over the gateway and use it for malicious purposes," said Mateo Rojas-Carulla, head of research for AI agent security at Check Point.
Check Point researchers detail two high-risk vulnerabilities
On October 13, Check Point published findings that two high-risk vulnerabilities — tracked as CVE-2026-35029 and CVE-2026-59823 — exist in LiteLLM, an open-source large language model (LLM) gateway tool. LiteLLM is widely used, with almost 100,000 downloads a month, to connect enterprise applications to model providers including OpenAI, Google and Anthropic. Check Point reported the flaws through coordinated disclosure and notes the vulnerabilities affect versions older than 1.83.9; LiteLLM version 1.83.9 and later include fixes.
CVE-2026-35029: missing authorization check can lead to full takeover
Check Point's analysis shows CVE-2026-35029 stems from a missing authorization check that can let low-privileged users reach administrative functions. By modifying a runtime configuration, an attacker could open the gateway to full system takeover. The research team warned that an exploit could enable remote code execution via malicious Python modules loaded from cloud storage, together with file access and theft of login credentials.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogCVE-2026-59823: SSRF that can expose AI provider API keys
The second flaw, CVE-2026-59823, is a server-side request forgery (SSRF) issue that could be abused to redirect the gateway’s outbound requests. Because LLM gateways commonly store API keys for all AI providers an organization uses, Check Point warned that SSRF could expose those provider API keys — a direct path to abuse of downstream model backends.
Why LiteLLM gateways are a particularly valuable target
LLM gateways sit between applications and one or more model backends and are used to centralize credential management, logging and usage tracking. That central role means a single compromised gateway can give an attacker access to API keys, stored credentials, and role-and-permission controls across an organization’s AI deployments. Christopher Jess, senior R&D manager at Black Duck, summarized the problem: “These findings are familiar application security failures. A missing permission check allowed low-privileged users to reach administrative functions with consequences including code execution.” He added that “centralizing AI access makes such gateways a particularly valuable target which should be secured accordingly.”
How organizations should respond — Check Point's recommendations
- Update LiteLLM to version 1.83.9 or later; those releases include fixes for both vulnerabilities.
- Review who has access to your gateway. Check Point emphasizes auditing user accounts and removing those no longer needed, since any account on a vulnerable deployment could be used to exploit the flaws.
- Rotate AI provider API keys stored in LiteLLM if there is any indication the gateway was accessed by unauthorized users before patching.
- Verify permissions in practice. Confirm that users with limited roles are actually limited to avoid gaps between configured and enforced permissions, where vulnerabilities like CVE-2026-35029 do the most damage.
- Include LLM gateways in security assessments. Extend penetration tests and vulnerability assessments to cover AI tooling alongside web applications and cloud infrastructure.
What this means for technologists, procurement leaders, and end users
- Technologists and security teams: Audit LiteLLM deployments immediately, confirm versions, enforce least-privilege access, and extend testing to include gateway components that hold API keys and runtime configuration.
- Procurement and IT procurement leaders: Recognize that centralizing AI access concentrates risk — evaluate vendor and open-source tooling for secure-by-default configurations and timely patching workflows.
- End users and application owners: Treat gateway accounts as high-value credentials; if there is any suspicion of unauthorized access, rotate provider API keys and follow the gateway owner’s remediation steps.
Check Point framed these flaws as “familiar application security failures” amplified by the central role gateways play in AI architectures. The company has publicly described both vulnerabilities and urged users to move to LiteLLM 1.83.9 or later. Organizations that rely on LiteLLM should assume that any account on an unpatched deployment could be leveraged by an attacker and act accordingly.
