Security Flaws Found in Leading Open Source AI Gateway: LiteLLM Vulnerabilities Could Affect Millions of Users
- Two LiteLLM flaws allow low-privileged users to gain administrative control and execute malicious code
- Attackers could also steal API keys from the AI provider through a server-side request forgery bug.
- Organizations should upgrade to LiteLLM 1.83.9+ and rotate potentially exposed credentials
Security researchers recently discovered two vulnerabilities in a popular AI gateway that allowed threat actors to take full control of the system, steal sensitive files and API keys from the AI provider, and execute malicious code remotely.
The AI gateway in question is called LiteLLM. It is an open source solution that allows users to connect their applications to large language models (LLM) from different vendors, including OpenAI and Anthropic.
The connection goes through a single interface, where users can route requests, manage API keys, control user access, and monitor things like usage and costs.
Latest videos ofTechnologyRadar
Right now, LiteLLM supports about 140 AI providers and has become quite popular: it has over 90 million monthly downloads on GitHub and over 61,000 stars.
LiteLLM
However, security experts at Check Point Research (CPR) recently found two bugs in LiteLLM.
The first is an access control bug in the way LiteLLM applies permissions. It is tracked as CVE-2026-35029 and has been assigned a severity score of 8.7/10 (high). According to CPR, the bug allows least privileged users to access administrative functions that control the central configuration of the gateway, which, in turn, allows them to read files stored on the server, overwrite administrator credentials, download and execute malware, and more.
The second is a server-side request forgery bug, which allows gateway users to instruct LiteLLM to send API requests to third-party servers. In theory, threat actors could send API requests to servers under their own control and, since these carry authentication keys from the AI provider, this would deliver the credentials directly to the attackers. In turn, they could use the credentials to use other organizations’ AI accounts and increase their bills. The bug is tracked as CVE-2026-59823 and was assigned a severity score of 5.3/10 (medium).
“The credentials held by a gateway provide direct, billable access to AI providers without the need for additional authentication,” CPR explained. “Given the scale of LiteLLM adoption, a failure in this component has the potential to impact a large number of AI deployments at once.”
Vulnerable versions and patches
CPR says that all organizations running LiteLLM versions prior to 1.83.9 are exposed to both vulnerabilities. Security teams should also check for LiteLLM instances running indirectly, as the gateway is integrated into many internal platforms and tools used to build AI applications. As such, it could be present in environments where it was never implemented as a standalone solution.
LiteLLM has released a fix for both bugs included in version 1.83.9 and users are advised to install this as soon as possible. In addition to that, CPR advises users to review who has access to the gateway, as any account could be used to exploit these flaws. AI provider API keys stored in LiteLLM should be rotated if there is any indication that unauthorized users are accessing the gateway, and permissions should be verified in practice.
“Confirm that users with limited roles are actually limited, because the gap between configured and applied permissions is where flaws like CVE-2026-35029 cause the most damage,” CPR warns.
“Include LLM gateways in security assessments by expanding penetration testing and vulnerability assessments to cover AI tools along with web applications and cloud infrastructure.”
According to the researchers, both bugs are a “well-understood class” of bugs, meaning that AI infrastructure suffers from the same risks as enterprise software. That means organizations must approach the security of AI gateways “with the same rigor they apply to any other business-critical system.”
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment