Critical LiteLLM AI Gateway Flaw Exploited in Active Attacks
Attackers are actively targeting a severe authorization vulnerability (CVE-2026-35029) in LiteLLM, an AI gateway used to bridge enterprise applications with model providers. The flaw, affecting versions prior to 1.83.0, allows authenticated users with low-privilege roles (e.g., proxy_admin_viewer) to escalate access to full administrative control by exploiting the unprotected /config/update endpoint.
LiteLLM stores sensitive data including API keys, database credentials, AWS secrets, and administrative passwords making compromised deployments a prime target for credential theft, infrastructure access, or remote code execution. The vulnerability stems from missing authorization checks, enabling attackers to modify critical configurations.
Exploitation Techniques & Impact
Researchers observed threat actors leveraging the flaw to:
- Read sensitive files by manipulating the UI_LOGO_PATH setting to point to server-side files (e.g., /app/.env, /proc/self/environ), then retrieving contents via the unauthenticated /get_image endpoint.
- Overwrite credentials by altering UI_USERNAME and UI_PASSWORD, granting full dashboard control.
- Register malicious endpoints to facilitate remote code execution or secret exfiltration.
- Enumerate and generate API keys, create admin accounts, and delete models indicating active reconnaissance and takeover attempts.
Attack Timeline & Scope
- April 7, 2026: First probes targeting /config/update appeared one day after CVE-2026-35029’s public disclosure.
- February–June 2026: 3,900+ requests to LiteLLM admin endpoints were recorded, including 1,000+ attempts to exploit the flaw.
- Common targets: Attackers scanned for secrets in /app/.env, /home/litellm/.env, and configuration files, while also testing default master keys (e.g., sk-1234, sk-litellm-master-key).
Mitigation & Response
LiteLLM patched the issue in version 1.83.0 by enforcing the proxy_admin role for configuration changes. Organizations running vulnerable versions are advised to:
- Rotate all exposed secrets, including API keys, database passwords, and cloud credentials.
- Restrict admin endpoints behind authenticated reverse proxies or internal networks.
- Audit logs for suspicious activity on /config/update, /get_image, /key/generate, and other high-risk endpoints.
The campaign underscores the growing threat to AI infrastructure, with attackers actively mapping and compromising exposed gateways.
Source: https://cybersecuritynews.com/hackers-exploit-litellm-admin-api-flaw/
LiteLLM cybersecurity rating report: https://www.rankiteo.com/company/litellm
"id": "LIT1788351850",
"linkid": "litellm",
"type": "Vulnerability",
"date": "4/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Technology/AI',
'name': 'LiteLLM',
'type': 'AI Gateway Software'}],
'attack_vector': 'Exploitation of unprotected /config/update endpoint',
'data_breach': {'data_exfiltration': 'Yes',
'file_types_exposed': ['.env', 'Configuration files'],
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['API keys',
'Database credentials',
'AWS secrets',
'Administrative passwords']},
'date_detected': '2026-04-07',
'description': 'Attackers are actively targeting a severe authorization '
'vulnerability (CVE-2026-35029) in LiteLLM, an AI gateway used '
'to bridge enterprise applications with model providers. The '
'flaw allows authenticated users with low-privilege roles to '
'escalate access to full administrative control by exploiting '
'the unprotected /config/update endpoint. Compromised '
'deployments expose sensitive data including API keys, '
'database credentials, AWS secrets, and administrative '
'passwords.',
'impact': {'data_compromised': 'API keys, database credentials, AWS secrets, '
'administrative passwords',
'identity_theft_risk': 'High (PII exposure risk)',
'operational_impact': 'Full administrative control takeover, '
'remote code execution, secret exfiltration',
'systems_affected': 'LiteLLM AI Gateway (versions prior to '
'1.83.0)'},
'initial_access_broker': {'high_value_targets': ['/config/update',
'/get_image',
'/key/generate'],
'reconnaissance_period': 'February–June 2026'},
'investigation_status': 'Ongoing',
'lessons_learned': 'The incident highlights the growing threat to AI '
'infrastructure, with attackers actively mapping and '
'compromising exposed gateways. Organizations must '
'prioritize securing AI-related endpoints and rotating '
'secrets post-compromise.',
'motivation': ['Credential Theft',
'Infrastructure Access',
'Remote Code Execution'],
'post_incident_analysis': {'corrective_actions': ['Enforce proxy_admin role '
'for configuration changes',
'Patch to version 1.83.0'],
'root_causes': 'Missing authorization checks on '
'/config/update endpoint'},
'recommendations': ['Rotate all exposed secrets (API keys, database '
'passwords, cloud credentials).',
'Restrict admin endpoints behind authenticated reverse '
'proxies or internal networks.',
'Audit logs for suspicious activity on high-risk '
'endpoints.',
'Upgrade to LiteLLM version 1.83.0 or later.'],
'references': [{'source': 'Cyber Incident Report'}],
'response': {'containment_measures': ['Patch to version 1.83.0',
'Rotate all exposed secrets'],
'enhanced_monitoring': ['Audit logs for suspicious activity on '
'/config/update, /get_image, '
'/key/generate'],
'remediation_measures': ['Enforce proxy_admin role for '
'configuration changes',
'Restrict admin endpoints behind '
'authenticated reverse proxies']},
'title': 'Critical LiteLLM AI Gateway Flaw Exploited in Active Attacks',
'type': 'Authorization Vulnerability Exploitation',
'vulnerability_exploited': 'CVE-2026-35029'}