Check Point Research Finds Two High Risk LiteLLM Gateway Flaws Allowing Takeover and API Key Theft
Date: 2026-10-17
Tags: llmjacking, supply-chain
Executive Summary
Check Point Research disclosed two high risk vulnerabilities in LiteLLM, the widely used open source LLM gateway, that let low privileged users take over the gateway and steal AI provider API keys. CVE-2026-35029 is an access control flaw enabling full system takeover, and CVE-2026-59823 is a server side request forgery flaw that redirects gateway requests to attacker servers and captures API keys. Both are fixed in LiteLLM 1.83.9 and organizations on earlier versions should upgrade immediately.
Campaign Summary
| Field | Detail |
|---|---|
| Campaign / Malware | LiteLLM Gateway Vulnerabilities (CVE-2026-35029, CVE-2026-59823) |
| Attribution | Unknown (confidence: none) |
| Target | Organizations running the LiteLLM LLM gateway below version 1.83.9 |
| Vector | Exploitation of an access control flaw and a server side request forgery flaw in the LiteLLM gateway |
| Status | active |
| First Observed | 2026-10-13 |
Detailed Findings
According to Check Point Research, LiteLLM is an open source LLM gateway used inside large enterprises, startups, and many platforms used to build AI applications, with 97 million downloads per month and over 59,000 GitHub stars. Check Point Research reported that CVE-2026-35029, an access control flaw, allowed any user, including those with read only access, to reach administrative functions and take over the gateway. Check Point Research stated that CVE-2026-59823 is a server side request forgery flaw that let any gateway user direct outbound API requests to an attacker controlled server without validation, delivering the API keys LiteLLM uses to authenticate with OpenAI, Google, and Anthropic straight to the attacker. Check Point Research demonstrated full system takeover, file access, credential theft, and remote code execution in a controlled test environment, and noted that the SSRF impact includes theft of AI provider API keys, unauthorized use of the organization's AI provider accounts, and unexpected costs billed to the organization. Both vulnerabilities are fixed in LiteLLM version 1.83.9 and above.
MITRE ATT&CK Mapping
| Technique | ID | Context |
|---|---|---|
| Exploit Public-Facing Application | T1190 | CVE-2026-59823 SSRF lets any gateway user redirect outbound requests to attacker controlled servers |
| Valid Accounts | T1078 | CVE-2026-35029 lets low privileged and read only users perform administrative actions and take over the gateway |
IOCs
Domains
_Check Point Research published the two CVE IDs and the fixed version 1.83.9. No domains, hashes, or IPs were published._
Full URL Paths
_Check Point Research published the two CVE IDs and the fixed version 1.83.9. No domains, hashes, or IPs were published._
Splunk Format
_No IOCs available for Splunk query_
Affected Platforms
LiteLLM LLM gateway versions before 1.83.9Detection Recommendations
Upgrade LiteLLM to version 1.83.9 or later. Audit gateway logs for administrative actions performed by low privilege or read only accounts and for outbound API requests to unexpected destinations. Rotate AI provider API keys held in the gateway configuration and monitor provider dashboards for unauthorized usage and unexpected billing. Restrict network egress from the gateway to known AI provider endpoints so a redirected request cannot reach an attacker server.
References
- [Check Point Research] Check Point Research Discovers High Risk Vulnerabilities in LiteLLM, One of the Most Widely Used LLM Gateways (2026-10-13) — https://blog.checkpoint.com/security/check-point-research-discovers-high-risk-vulnerabilities-in-litellm-one-of-the-most-widely-used-llm-gateways/