CVE-2026-35029 Details
Description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to modify proxy configuration and environment variables, register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution, read arbitrary server files by setting UI_LOGO_PATH and fetching via /get_image, and take over other privileged accounts by overwriting UI_USERNAME and UI_PASSWORD environment variables. Fixed in v1.83.0.
A vulnerability in LiteLLM versions prior to 1.83.0 allows authenticated users to bypass admin role authorization on the /config/update endpoint. This exploitation can lead to unauthorized modifications of proxy configurations and environment variables, registration of custom endpoint handlers that execute attacker-controlled Python code, remote code execution, unauthorized access to privileged accounts by overwriting specific environment variables, and unauthorized reading of server files through a crafted request.
Users can upgrade to LiteLLM version 1.83.0 or later, where the vulnerability has been patched by requiring admin role authorization on the affected endpoint.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:13545 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:28960 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:30056 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-35029 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2455474 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35029.json | redhat-SADP | |
| http://seclists.org/fulldisclosure/2026/Apr/17 | CVE | |
| https://github.com/BerriAI/litellm/security/advisories/GHSA-53mr-6c8q-9789 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-425 | Direct Request ('Forced Browsing') | redhat-SADP |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| litellm litellm | < 1.83.0 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Apr 29, 2026 | CVE Modified | CVE |
| Apr 7, 2026 | Initial Analysis | [email protected] |
| Apr 6, 2026 | New CVE Received | [email protected] |