Two flaws found in open source AI gateway LiteLLM, millions of users at risk
Check Point Research found two vulnerabilities in the open source AI gateway LiteLLM: CVE-2026-35029 (8.7/10) lets low-privileged users gain admin control and run code, while CVE-2026-59823 (5.3/10) allows stealing AI provider API keys via SSRF. A fix shipped in version 1.83.9.
- CVE-2026-35029 (8.7/10): low-privileged users can take over the gateway
- CVE-2026-59823 (5.3/10): SSRF bug leaks AI provider API keys
- All LiteLLM versions below 1.83.9 are vulnerable
- LiteLLM supports about 140 AI providers and 90M monthly downloads
Read next
Security