Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · LiteLLM

CVE-2026-35029: LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint

highCVSS 4.0 8.7GHSA-53mr-6c8q-9789

Impact The /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to do the following: - Modify proxy configuration and environment variables - Register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution - Read arbitrary server files by setting UILOGOPATH and…

Published Apr 3, 2026 · Updated May 6, 2026

Affected packages

litellm

Ecosystem
PyPI
Affected
< 1.83.0
Fixed in
1.83.0
Check
pip show litellm

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Impact

The /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to do the following:

  • Modify proxy configuration and environment variables
  • Register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution
  • Read arbitrary server files by setting UI_LOGO_PATH and fetching via /get_image
  • Take over other priveleged accounts by overwriting UI_USERNAME and UI_PASSWORD environment variables

Patches

Fixed in v1.83.0. The endpoint now requires proxy_admin role.

Workarounds

Restrict API key distribution. There is no configuration-level workaround.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More LiteLLM vulnerabilities

All LiteLLM entries