LiteLLM AI Gateway Privilege Escalation via Unrestricted /config/update Endpoint

CVE-2026-35029 is an incorrect-authorization flaw in LiteLLM's /config/update endpoint. Prior to version 1.83.0, the endpoint performs no role check — any holder of a valid API key (even the lowest-privilege internal_user role) can POST arbitrary JSON to rewrite the proxy's runtime configuration and environment variables. From there, three immediate chains open: (1) set UI_LOGO_PATH to /app/.env and call the unauthenticated /get_image endpoint to exfiltrate secrets, (2) overwrite UI_USERNAME and UI_PASSWORD to seize the admin dashboard, and (3) register a custom pass-through endpoint handler pointing to attacker-controlled Python code, achieving remote code execution running as root inside the container. Affected versions: all LiteLLM releases < 1.83.0. Fixed in v1.83.0.

The vendor's HIGH / 8.8 score is defensible but slightly generous for the *average* deployment. The CVSS vector correctly captures AV:N/AC:L/PR:L/UI:N, reflecting the low-privilege authentication requirement. However, the score assumes a uniform population. In reality, the auth barrier is porous: Wiz found ~10% of publicly exposed instances accept the default master key sk-1234 or require no authentication at all, effectively making this PR:N for a meaningful slice of the installed base. Against that slice, the real-world severity is closer to 9.8. Conversely, well-managed internal deployments behind a VPN with rotated keys face genuine friction at step one. Balancing these populations, we downgrade slightly to 8.3 — the auth prerequisite provides *some* friction, but active exploitation and default-credential prevalence prevent a larger reduction.

Sources.

1. GitHub Advisory — GHSA-53mr-6c8q-9789
2. Check Point Research — LiteLLM Gateway Vulnerabilities
3. Wiz — Breaking LiteLLM: From Auth Bypass to Cloud Compromise
4. SecurityOnline — CVE-2026-35029 Exploited for Full Server Takeover
5. LiteLLM Vendor Advisory — Security Hardening April 2026
6. PoC Repository — learner202649/CVE-2026-35029-PoC
7. CyberNews — Thousands of LiteLLM Instances Exposed
8. Pentest-Tools — LiteLLM Arbitrary File Read Scanner

Run this script on any host where LiteLLM is installed (typically the container itself or the Python virtualenv hosting the proxy). Invoke with python3 check_cve_2026_35029.py. No special privileges required — it only reads package metadata via pip.

#!/usr/bin/env python3
"""CVE-2026-35029 checker — LiteLLM privilege escalation via /config/update
Outputs: VULNERABLE / PATCHED / UNKNOWN
Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
"""
import subprocess
import sys
import re

FIXED_VERSION = (1, 83, 0)

def parse_version(v_str):
    """Parse version string to tuple of ints."""
    parts = re.findall(r'\d+', v_str)
    return tuple(int(p) for p in parts[:3])

def main():
    try:
        result = subprocess.run(
            [sys.executable, '-m', 'pip', 'show', 'litellm'],
            capture_output=True, text=True, timeout=30
        )
    except Exception as e:
        print(f'UNKNOWN — could not run pip: {e}')
        sys.exit(2)

    if result.returncode != 0 or 'Name: litellm' not in result.stdout:
        print('UNKNOWN — litellm package not found in this Python environment.')
        print('If LiteLLM runs in a container, exec into it and re-run.')
        sys.exit(2)

    version_match = re.search(r'^Version:\s*(.+)$', result.stdout, re.MULTILINE)
    if not version_match:
        print('UNKNOWN — could not parse litellm version from pip output.')
        sys.exit(2)

    version_str = version_match.group(1).strip()
    try:
        installed = parse_version(version_str)
    except (ValueError, IndexError):
        print(f'UNKNOWN — unparseable version string: {version_str}')
        sys.exit(2)

    print(f'Installed litellm version: {version_str}')
    print(f'Fixed in: {".".join(str(x) for x in FIXED_VERSION)}')

    if installed < FIXED_VERSION:
        print(f'VULNERABLE — litellm {version_str} is affected by CVE-2026-35029.')
        print('Action: upgrade to >= 1.83.0 (recommend 1.83.9+ for full hardening).')
        sys.exit(1)
    else:
        print(f'PATCHED — litellm {version_str} includes the fix for CVE-2026-35029.')
        sys.exit(0)

if __name__ == '__main__':
    main()