Two LiteLLM flaws let a basic user account take over the gateway or capture AI provider keys

CVE-2026-35029 is a permissions failure. LiteLLM uses role based access control: administrators run the system, and everyone else gets limited or read only access ^[5]. The flaw let minimal-privilege users reach the administrative functions that control the gateway's core configuration ^[5].

From there Check Point lists three moves. An attacker could read files on the server, including configuration and system files. They could overwrite administrator credentials with their own and lock the real administrators out. And they could instruct the gateway to download and execute code from an external source ^[6]. That last step is the route to malware installation, data exfiltration or movement to other systems on the network ^[7].

CVE-2026-59823 works at the request level. A gateway user supplies a malicious destination inside a request, and LiteLLM creates a new route to the attacker's server without validating it ^[10]. The redirected requests carry the keys LiteLLM uses to authenticate with AI providers ^[10]. The gateway stores keys for every provider the organization uses, so it is a concentrated target ^[16]. Check Point says the theft needs no compromise of OpenAI, Anthropic or any other provider ^[11].

We think CVE-2026-35029 is the larger exposure. It ends in code execution on the gateway host ^[6]. CVE-2026-59823 ends at credentials ^[10]. Both start from an ordinary account, so neither is easier to reach than the other ^[15].

All of this comes from Check Point, which found the flaws and ran the demonstrations. Its post does not report exploitation in the wild, name a threat actor, or include severity scores and disclosure dates. Check Point says it responsibly disclosed both issues to LiteLLM ^[14].