CVE-2026-35029: BerriAI LiteLLM incorrect authorization in config update endpoint

CVE-2026-35029 · Severity: high · CVSS 8.8 · Published 2026-04-06

LiteLLM is an AI gateway used to manage and proxy requests to various Large Language Model (LLM) providers. A security flaw allows any authenticated user to access administrative configuration settings that should be restricted. An attacker could exploit this to steal sensitive credentials, read private server files, or execute malicious code, potentially leading to a full takeover of the AI infrastructure.

Technologies: Berriai LiteLLM, litellm (PyPI), Red Hat Lightspeed Core. Vendors: Berriai, PyPI, Red Hat.

Quick answers

Is CVE-2026-35029 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-35029 being exploited in the wild.
How severe is CVE-2026-35029?
High severity, with a CVSS score of 8.8, published 6 April 2026.
Which products and versions are affected?
Berriai LiteLLM < 1.83.0; litellm (PyPI) ECOSYSTEM:introduced=0,fixed=1.83.0; Red Hat Lightspeed Core affected.
Is there a fix for CVE-2026-35029?
Yes. litellm (PyPI): upgrade to 1.83.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35029 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-35029?
Check whether you run Berriai LiteLLM, litellm (PyPI) or Red Hat Lightspeed Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • litellm (PyPI): upgrade to 1.83.0 or later
    pip install "litellm>=1.83.0"

Technical details

A broken access control vulnerability exists in the `/config/update` endpoint of LiteLLM due to a missing authorization check for the 'proxy_admin' role. An authenticated attacker with low-level privileges can send a request to this endpoint to modify proxy configurations and environment variables. This can be leveraged to register custom pass-through endpoint handlers pointing to attacker-controlled Python code for Remote Code Execution (RCE). Additionally, attackers can exfiltrate sensitive environment variables (like DATABASE_URL) or read arbitrary system files (such as /etc/passwd) by manipulating the UI_LOGO_PATH and using the /get_image endpoint. The vulnerability is fixed in version 1.83.0.

Affected products

  • BerriAI litellm < 1.83.0
  • Red Hat Red Hat Ansible Automation Platform 2.6 affected
  • Red Hat Red Hat OpenShift AI 2.25 affected
  • Red Hat Red Hat OpenShift AI 3.3 affected
  • Red Hat Lightspeed Core affected

Identifiers

  • CVE-2026-35029
  • GHSA-53mr-6c8q-9789
  • PYSEC-2026-2597

Timeline

  • 2026-02-24: other: Vulnerability discovered by SEC Consult
  • 2026-04-01: patched: Security patch released in nightly build
  • 2026-04-03: advisory: GitHub security advisory published
  • 2026-04-06: disclosed: NVD publication date
  • 2026-04-21: other: Coordinated release of SEC Consult advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.