Check Point finds two LiteLLM flaws that expose every provider key the gateway stores
LiteLLM 1.83.9 fixes two Check Point-reported flaws, CVE-2026-35029 and CVE-2026-59823, that affect every older version of the gateway. A DEV Community patch guide pairs the upgrade with key rotation and an audit of what the gateway held.
The Engineer · Build desk
Lowest-privilege users could modify runtime configuration. Per Check Point, the host faces file access, credential theft and code execution. SSRF can redirect requests carrying OpenAI, Anthropic and Google keys. Teams on 1.83.9 should audit. Key rotation needs provider dashboard admin access.
- What's now possible capability Lowest-privilege users Any authenticated user could modify the gateway's runtime configuration (CVE-2026-35029), claim 3
- Who's exposed exposure Gateway host Per Check Point: file access, credential theft and remote code execution via malicious Python modules, claim 4
- Who's exposed exposure Stored provider API keys SSRF lets an attacker redirect outbound requests carrying the OpenAI, Anthropic and Google keys, claim 5
- Who has to decide decision Teams on 1.83.9 or later Should still run the audit step if they ever ran an older build, claim 10
- What it limits constraint Whoever rotates keys Needs admin access to the LiteLLM UI and to the AI provider dashboards, claim 13
| Who | How | Kind | Claim |
|---|---|---|---|
| Lowest-privilege users | Any authenticated user could modify the gateway's runtime configuration (CVE-2026-35029) | capability | 3 |
| Gateway host | Per Check Point: file access, credential theft and remote code execution via malicious Python modules | exposure | 4 |
| Stored provider API keys | SSRF lets an attacker redirect outbound requests carrying the OpenAI, Anthropic and Google keys | exposure | 5 |
| Teams on 1.83.9 or later | Should still run the audit step if they ever ran an older build | decision | 10 |
| Whoever rotates keys | Needs admin access to the LiteLLM UI and to the AI provider dashboards | constraint | 13 |
What happened
- The runtime configuration endpoint behind CVE-2026-35029 had no authorization check, so any authenticated user, even at the lowest-privilege role, could change the gateway's runtime configuration.
- According to Check Point's findings as the guide relays them, that escalates to file access, credential theft and remote code execution through malicious Python modules loaded from cloud storage.
- CVE-2026-59823 is a server-side request forgery that lets an attacker redirect outbound requests carrying the OpenAI, Anthropic and Google keys to a destination the attacker controls.
- The guide puts LiteLLM downloads at roughly 100,000 developers a month.
Why it matters
- Who's exposed exposure On an unpatched gateway, every person or service holding any account is a possible route to the host, so the user list matters as much as the network perimeter.
- What it limits constraint A patch closes the path but cannot recall a key that already left or remove a foothold planted earlier, which is why the guide adds rotation and an audit to the upgrade.
- What it costs cost Rotation takes admin access on every provider dashboard behind the gateway, so teams that split gateway admin from provider billing admin need both people in the same change window.
- Who has to decide decision Teams already on 1.83.9 still have to decide how far back to audit, because the guide says the flaws were live in any older build they ran.
The two flaws have different entry conditions. The first needs a login, so on an unpatched gateway the list of people holding accounts is the attack surface [3]. Mateo Rojas-Carulla, Check Point's head of research for AI agent security, said anyone holding an account on a vulnerable deployment could take over the gateway [6]. Christopher Jess, a senior R&D manager at Black Duck, called the pattern "painfully familiar": because a permission check was missing, users with low privileges could get to administrative functions, and that ended in code execution [7].
A gateway exists to centralize credentials, logging and usage tracking [16]. That puts every provider key behind one set of accounts. The post describes a takeover as a "standing foothold". From there the attacker can run code on the host, read its files and pivot onward, and the exposed keys include OpenAI, Anthropic and Gemini plus whatever else is configured [8].
In our view the order of operations matters. The upgrade closes both paths [2]. It does not revoke a key that already left the host, and it does not remove a foothold planted through the first flaw. The post's routine has four steps: check, patch, rotate, audit [9]. It tells anyone already on 1.83.9 or later to run the audit anyway, because the flaws were live in the history of any older build they ran [10].
The post does not say what access CVE-2026-59823 requires, and it does not report exploitation of either flaw. We'd still rotate on any gateway that ran an older build with accounts issued to other people. Rotation needs admin access to the provider dashboards, so whoever holds the LiteLLM admin login may not be the person who can do it [13].
The mechanical steps are short. Inside the container, `pip show litellm` reports the version, and anything below 1.83.9 is vulnerable [11]. For Docker Compose installs the post pulls the new image and brings the stack back up [12]. We'd rerun the version check afterward, since a pull helps only if the image tag moved.
The post singles out self-hosted n8n setups. It says LiteLLM is the natural way to give AI Agent nodes one OpenAI-compatible endpoint with fallbacks and load balancing [15].
What to watch
- Whether LiteLLM or Check Point publishes what access CVE-2026-59823 requires, and whether either flaw has been exploited.
- Whether provider usage logs show unexplained traffic on keys that sat in a gateway running a version older than 1.83.9.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence45
- Adoption55
- Hype gap+20
- Incentives
- Not scored
- Confidence50
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Check Point's AI agent security team found two vulnerabilities in LiteLLM: CVE-2026-35029 and CVE-2026-59823.
- [2]
Both vulnerabilities are fixed in LiteLLM 1.83.9, and anything older than 1.83.9 is affected.
- [3]
CVE-2026-35029 is a missing authorization check on LiteLLM's runtime configuration endpoint, so any authenticated user, even one with the lowest privilege role, could modify the gateway's runtime configuration.
- [4]
Per Check Point's findings, the missing check leads to full system takeover: file access, credential theft, and remote code execution via malicious Python modules loaded from cloud storage.
- [5]
CVE-2026-59823 is a server-side request forgery flaw that lets an attacker redirect the gateway's outbound requests, which carry the OpenAI, Anthropic and Google API keys, toward an attacker-controlled destination.
- [6]
Mateo Rojas-Carulla, Check Point's head of research for AI agent security, said anyone holding an account on a vulnerable deployment could take over the gateway.
- [7]
Christopher Jess, senior R&D manager at Black Duck, noted the pattern is painfully familiar: a missing permission check let low-privileged users reach administrative functions, with code execution as the consequence.
- [8]
A gateway takeover is a standing foothold: the attacker can execute code on the host, read files and pivot further, and a compromised gateway exposes every key configured, including OpenAI, Anthropic, Gemini and whatever else is set up.
- [9]
The post gives a four-step check, patch, rotate and audit procedure for anyone running LiteLLM.
- [10]
Anyone on 1.83.9 or later should skip to the audit step and still do it, because the flaws were live in the version history if they ever ran an older build.
- [11]
Running pip show litellm (inside the container via docker exec for Docker installs) reports the version, and anything below 1.83.9 is vulnerable.
- [12]
For Docker Compose installs, the patch step is docker compose pull followed by bringing the stack back up with docker compose up.
- [13]
The procedure requires admin access to the LiteLLM UI and to the AI provider dashboards in order to rotate keys.
- [14]
LiteLLM is an open-source LLM gateway that roughly 100,000 developers download every month.
- [15]
If you self-host n8n, LiteLLM is the natural way to give all your AI Agent nodes one OpenAI-compatible endpoint, with fallbacks, load balancing and a single bill.
- [16]
An LLM gateway sits between an application and the model providers, and LiteLLM is a proxy that centralizes credentials, logging and usage tracking.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- dev.toYour LLM Gateway Holds Every API Key. LiteLLM Let Any User Steal Them: CVE-2026-35029 Patch Guide
1 article · October 16, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.