Critical LiteLLM Flaws Allow Admin Takeover and API Key Theft
Two critical vulnerabilities in LiteLLM, a widely used open-source AI gateway, allowed low-privilege users to escalate privileges, execute arbitrary code, and steal sensitive API keys from AI providers such as OpenAI and Anthropic. The root cause lies in insufficient input validation and improper access control within the application, enabling attackers to move laterally and compromise administrative accounts. This is particularly dangerous given that LiteLLM acts as a centralized gateway, meaning a single compromise can expose all connected AI provider credentials. Organizations slow to patch open-source dependencies in AI pipelines face compounding risk as these tools rapidly proliferate in production environments. Fixes are available in version 1.83.9 and later, making prompt patching essential.
Tactical Insight
Immediate actions
- Upgrade all LiteLLM deployments to version 1.83.9 or later immediately to remediate CVE-2026-35029 and CVE-2026-59823.
- Rotate all AI provider API keys stored in or accessible via LiteLLM as a precautionary measure following disclosure.
- Restrict network access to LiteLLM admin interfaces using firewall rules or allowlists to reduce the attack surface.
Long-term improvements
- Maintain a software inventory (SBOM) for all open-source AI/ML dependencies and subscribe to their security advisories.
- Enforce least-privilege principles so that low-privilege users cannot access administrative endpoints or sensitive credential stores.
- Implement automated vulnerability scanning of open-source components within your CI/CD pipeline to catch flaws before they reach production.
Detection measures
- Enable detailed audit logging on LiteLLM and centralize logs in a SIEM to detect anomalous privilege escalation or unexpected API key access.
- Set up alerts for unusual outbound API calls or authentication attempts that may indicate stolen credentials being used externally.
- Conduct periodic penetration testing of AI gateway infrastructure to proactively identify privilege escalation paths.