Researchers have uncovered two high-risk security flaws in LiteLLM, an open-source gateway tool that organizations use to connect their AI applications to providers like OpenAI, Google, and Anthropic. The vulnerabilities were detailed in a blog post published on October 13 by Check Point, which warned that the weaknesses could allow any user to gain administrative control over the gateway, potentially leading to complete system compromise. The tool, which sees nearly 100,000 downloads monthly, is deployed widely across enterprises to help build AI applications and services.
The two security gaps, designated CVE-2026-35029 and CVE-2026-59823, affect LiteLLM versions older than 1.83.9. The first vulnerability could permit attackers to exploit a missing authorization check to alter runtime configurations, potentially enabling full system takeover and remote code execution through malicious Python modules loaded from cloud storage. The second flaw could let an attacker exploit server-side request forgery to reroute the gateway's outbound requests, exposing API keys for AI providers. Because LLM gateways typically centralize credential management, logging, and usage tracking, they store API keys for every AI provider an organization uses and manage user access through roles and permissions.
According to Mateo Rojas-Carulla, head of research for AI agent security at Check Point, "anyone holding an account on a vulnerable LiteLLM deployment could take over the gateway and use it for malicious purposes." Christopher Jess, senior R&D manager at Black Duck, an application security company, noted that the discoveries represent "familiar application security failures" where a missing permission check allowed low-privileged users to reach administrative functions with consequences including code execution. He added that centralizing AI access makes such gateways "a particularly valuable target which should be secured accordingly," calling the findings "another example of the worrying trend of security fundamentals being treated as secondary concerns as adoption of the AI ecosystem accelerates."
Check Point reported both vulnerabilities through coordinated disclosure, and LiteLLM version 1.83.9 and all subsequent versions include patches to close the security gaps. The vulnerabilities are especially concerning because LLM gateways serve as intermediaries between applications and one or more LLM providers, routing requests to appropriate model backends instead of having applications call model APIs directly. This centralized position gives gateways control over API credentials, user permissions, and logging—making them high-value targets for attackers. A successful exploit would grant an attacker not only access to files and login credentials but also the ability to execute code remotely across the organization's AI infrastructure.
Beyond updating to the latest LiteLLM version, the research recommends several protective measures: reviewing who has access to gateways and removing unnecessary accounts, rotating AI provider API keys if unauthorized access occurred before patching, verifying that users with limited roles are actually restricted in practice, and extending penetration tests and vulnerability assessments to cover AI tooling alongside traditional web applications and cloud infrastructure. The gap between configured and enforced permissions is where flaws like CVE-2026-35029 cause the most damage, according to the findings. Organizations rushing to deploy AI capabilities may be overlooking fundamental security practices that would normally gate any enterprise software rollout. The vulnerabilities highlight how governance frameworks built for traditional infrastructure don't automatically extend to newer AI toolchains, leaving blind spots that sophisticated adversaries will likely probe.