Check Point discloses LiteLLM flaws that enabled gateway takeover and API-key theft

LiteLLM gives organizations one place to manage AI-provider access, but two flaws let ordinary gateway users cross the boundaries meant to contain them. Check Point Research’s October 13 disclosure describes paths to administrative takeover and provider API-key theft. Both are fixed in version 1.83.9; the researchers demonstrated the attacks in a controlled test environment.

An AI gateway sits between an application and the model providers it uses. Instead of connecting to each provider directly, the application sends requests through the gateway. LiteLLM can centralize provider credentials, request routing, user permissions and usage tracking. That puts access controls and valuable credentials inside the same service, rather than leaving each application to manage its own connections.

Check Point assessed gateway version 1.77.7. Its findings concern two different failures: CVE-2026-35029 allowed users with limited permissions to change administrative settings, while CVE-2026-59823 allowed gateway requests carrying provider credentials to be redirected. Neither attack path depended on the user already having administrator privileges.

A dashboard login opened an administrative route

The access-control flaw centered on POST /config/update, a route designed to change the gateway’s configuration while it is running. It accepted authenticated requests without separately checking that the caller had the administrator role. Authentication answered whether the user could log in; the missing permission check should have answered whether that user could change critical settings.

A second part of the permission logic let dashboard sessions reach that route. LiteLLM classified dashboard login tokens as UI tokens and checked them against a list of allowed routes. That list included /config, and the check accepted any route beginning with that text. As a result, /config/update passed too, regardless of the dashboard user’s actual role.

Configuration access then provided several routes to deeper control. Users could change environment variables—the settings read by the running service. One controlled the file served as the dashboard logo. By changing that setting, researchers made the gateway return a server file instead of an image, exposing files accessible to the LiteLLM process.

The same ability let a low-privilege user replace the username and password used for the default administrator login. Matching those credentials granted full administrator access. Check Point also described a route to remote code execution—running attacker-chosen code on the gateway—through malicious Python modules loaded from cloud storage.

The credentials a gateway holds provide direct, billable access to AI providers with no further authentication required.

Check Point Research

A redirected request carried the provider’s key

The second flaw was server-side request forgery, or SSRF: a user could make the gateway send a request to a destination the attacker controlled. It affected LiteLLM’s Clientside LLM Credentials feature. Rather than reaching the intended AI provider, a redirected request could arrive at the attacker’s server with the provider API key attached.

That changes the consequence from a misrouted request to reusable account access. Check Point’s security advisory explains that stolen keys could support unauthorized use of an organization’s AI-provider accounts and unexpected charges. The theft would not require compromising OpenAI, Anthropic or another provider: the gateway itself would deliver the credential used to authenticate.

Patch the gateway—and check where it is embedded

Check Point says its coordinated disclosure process with LiteLLM began in October 2025. Both vulnerabilities are resolved in version 1.83.9 and later. It advises organizations running earlier versions to update immediately; the October 13 publication is a disclosure of the findings, not an announcement that the fix was released that day.

The inventory should extend beyond services explicitly deployed as LiteLLM. Check Point warns that the gateway can also run inside AI-development platforms and internal tools. A team may therefore need to check software that uses it indirectly, rather than stop after reviewing its standalone gateway installations.

Check Point’s additional recommendations

• Review gateway accounts and remove access that is no longer needed. A basic account was enough to reach the vulnerable functions.
• Rotate stored AI-provider keys if there is any indication of unauthorized gateway access before patching.
• Test whether limited roles are actually restricted, and include AI gateways in penetration tests and vulnerability assessments alongside other infrastructure.