Two security vulnerabilities discovered in LiteLLM have raised concerns about the safety of AI infrastructure used by organizations to connect applications with multiple large language model providers. The flaws could allow attackers to gain administrative access, execute malicious code and steal sensitive credentials, putting business systems and AI services at risk.
LiteLLM is an open source AI gateway that provides a unified interface for connecting applications to services from providers such as OpenAI and Anthropic. It enables organizations to route model requests, manage API keys, control user permissions and track usage and costs through a central platform.
The gateway has attracted considerable attention from developers and businesses building AI powered applications. According to the report, the project records more than 90 million monthly downloads and has accumulated over 61,000 GitHub stars, highlighting its widespread adoption.
However, researchers at Check Point Research have identified weaknesses that could expose deployments to serious security risks. The findings underline how vulnerabilities in a central AI gateway can have consequences beyond a single application, particularly when the system holds privileged credentials and manages access to multiple AI services.
Privilege Escalation Flaw Could Give Attackers Administrative Control
The first vulnerability, tracked as CVE 2026 35029, received a severity score of 8.7 out of 10. It concerns a weakness in LiteLLM’s access control mechanisms that could allow users with limited privileges to reach administrative functions.
Under normal circumstances, access controls should prevent ordinary users from changing critical settings or performing operations reserved for administrators. The vulnerability creates a gap between the permissions assigned to an account and the actions the system actually allows it to perform.
If successfully exploited, the flaw could give an attacker access to sensitive administrative capabilities. Depending on the affected deployment and the privileges available through those functions, the consequences could include reading files stored on the server, changing administrator credentials and downloading or executing malicious software.
Such access could turn a relatively limited account into an entry point for a much broader compromise. An attacker who gains control of the gateway may be able to interfere with its configuration, access sensitive information or use the system as a foothold for further attacks.
For organizations that depend on LiteLLM to manage several AI services, the potential impact extends beyond the gateway itself. The system may contain credentials, configuration details and other information that could help an attacker access connected services.
SSRF Vulnerability Could Expose AI Provider API Keys
The second flaw, identified as CVE 2026 59823, involves server side request forgery, commonly known as SSRF. It received a severity score of 5.3 out of 10.
SSRF vulnerabilities occur when an application can be manipulated into sending requests to destinations selected by an attacker. In the LiteLLM case described by researchers, the weakness could allow users to direct requests towards third party servers under their control.
The main concern is the sensitive information that may accompany those requests. AI gateways frequently store provider API keys to authenticate requests on behalf of applications. If an attacker can cause a gateway to send these credentials to an external destination, the keys could be exposed.
Stolen API keys can create immediate financial and security problems. Attackers may use them to access AI services under another organization’s account, generate unauthorized usage and increase billing costs. Depending on the permissions attached to the credentials, the exposure could also create additional opportunities for abuse.
Unlike a conventional application vulnerability that affects a single user session, a compromised gateway can put shared credentials at risk. This makes it important for organizations to understand which secrets their AI infrastructure stores and how those credentials are transmitted.
The researchers also highlighted the broader significance of these risks. AI provider credentials can provide direct access to billable services, making them valuable targets for attackers looking to exploit an organization’s AI spending.
LiteLLM Users Urged to Upgrade and Review Credentials
According to the reported security advisory, LiteLLM versions earlier than 1.83.9 are affected by the two vulnerabilities. The release of LiteLLM 1.83.9 includes fixes for both issues, and organizations should prioritize upgrading affected installations.
Security teams should also look beyond standalone deployments. LiteLLM may be integrated into internal development tools, AI platforms and other applications, meaning vulnerable instances could exist in environments where teams do not realize the gateway is being used.
Updating the software is an essential first step, but organizations should not assume that patching alone resolves every possible consequence of an earlier exposure.
Administrators should review access logs, investigate suspicious account activity and check whether unauthorized users may have accessed the gateway. They should also verify that accounts with limited roles cannot reach privileged administrative functions.
If there is evidence or a credible indication that an instance has been compromised, organizations should rotate potentially exposed AI provider API keys and other affected credentials. They should also review billing activity and revoke unauthorized access where necessary.
The incident reinforces the need to apply established security practices to AI infrastructure. Regular vulnerability assessments, penetration testing, strict access controls and careful management of secrets remain essential, even when the software is designed primarily to simplify access to AI models.
Follow TechBSB For More Updates
