Check Point Details LiteLLM Flaws Enabling File Reads, Admin Takeover and Remote Code Execution

Summary

Check Point researchers found authorization and SSRF vulnerabilities in LiteLLM 1.77.7 that could enable file reads, admin takeover, code execution, and provider-key theft. The issues were fixed in version 1.83.9.

Key points

A missing role check and permissive UI route matching let authenticated low-privilege users modify runtime configuration through POST /config/update.
By changing environment variables, attackers could read accessible files and take over the proxy’s administrator account.
Malicious Python modules loaded from S3 or GCS through pass-through endpoints could execute code on the LiteLLM host.
The “Clientside LLM Credentials” feature allowed SSRF by routing API requests to attacker-controlled endpoints, potentially exposing provider API keys.
Researchers also reported exposure of password hashes and weak, unsalted password hashing.
The findings include CVE-2026-35029 and CVE-2026-59823; the article says the vulnerabilities were resolved in LiteLLM 1.83.9.

Article Details

Attack Vectors: An authorization bypass in LiteLLM's POST /config/update endpoint allowed authenticated low-privilege users to alter runtime configuration, including environment variables and pass-through endpoints.
By setting UI_LOGO_PATH to a sensitive local file path and requesting /get_image, an attacker could read files accessible to the LiteLLM process.
Overwriting UI_USERNAME and UI_PASSWORD through the configuration endpoint could let an attacker log in as the LiteLLM proxy administrator.
A pass-through endpoint target using an s3:// or gcs:// location could cause LiteLLM to download and execute a Python module, enabling remote code execution.
The Clientside LLM Credentials feature accepted attacker-controlled user_config values, including api_base destinations, allowing SSRF, API-key exposure, and probing of internal networks.
Authenticated low-privilege users could retrieve password hashes for other users; the article reports hashes were unsalted and generated with a single iteration, increasing the feasibility of offline cracking.
Defensive Notes: Upgrade LiteLLM to version 1.83.9 or later; the article says the reported vulnerabilities were resolved by that version.
Enforce explicit role-based authorization on administrative endpoints such as /config/update.
Use exact route matching or otherwise prevent permissive UI route-prefix checks from authorizing sensitive API routes.
Validate and restrict user-supplied configuration, file paths, remote module sources, and api_base destinations.
Use modern salted password-hashing algorithms rather than a single iteration of an unsalted standard hash.