---
title: "[AUTO] Any User Can Become Admin in LiteLLM"
pubDatetime: 2026-10-13T17:14:00.000Z
description: "Check Point Research uncovers critical privilege escalation in the widely-used LiteLLM gateway."
tags: [ai-security, vulnerability, credentials, 2026, 2026-q4, 2026-10, AUTO]
---
[Check Point Research](https://research.checkpoint.com/2026/when-llm-gateways-go-wrong-findings-from-litellm/) disclosed two critical vulnerabilities in LiteLLM, a gateway handling 97 million API calls monthly. CVE-2026-35029 lets any authenticated user reach admin functions, executing arbitrary code via malicious Python modules. CVE-2026-59823 redirects gateway traffic to steal LLM provider credentials.

The core flaw: read-only users escalate to admin. LiteLLM's model doesn't distinguish privilege levels, only API key existence. In shared deployments, that's catastrophic.

A gateway sits between your application and expensive LLM providers. Compromise it and attackers control the channel, stealing credentials and exposing every downstream system.

Researchers demonstrated complete system compromise: file access, credential theft, remote code execution. Both flaws are patched in v1.83.9+. Disclosure began October 2025 with [active exploitation](https://labs.cloudsecurityalliance.org/research/csa-research-note-litellm-cve-2026-42271-ai-gateway-exploita/) already reported. If you run LiteLLM, upgrade now. If you're evaluating gateways, auth design matters.

---

*Sources: [When LLM Gateways Go Wrong: Findings from LiteLLM](https://research.checkpoint.com/2026/when-llm-gateways-go-wrong-findings-from-litellm/)  •  [Check Point Research Discovers High Risk Vulnerabilities in LiteLLM](https://blog.checkpoint.com/security/check-point-research-discovers-high-risk-vulnerabilities-in-litellm-one-of-the-most-widely-used-llm-gateways)*

*Coverage: [CSA Research Note: LiteLLM RCE via MCP Injection](https://labs.cloudsecurityalliance.org/research/csa-research-note-litellm-cve-2026-42271-ai-gateway-exploita/)  •  [SEC Consult: Broken Access Control in Config Endpoint](https://seclists.org/fulldisclosure/2026/Apr/17)*

*Related on this blog: [[AUTO] MemTensor Worm Exploits GitHub Actions Token Interception](/posts/auto-memtensor-sckit-worm)  •  [[AUTO] Encrypted Instructions Trick Copilot CLI Into Stealing Secrets](/posts/auto-copilot-context-injection)  •  [FortiBleed Ran on a Command Fortinet Ships in the Box](/posts/fortibleed-fortinet-credential-harvesting)*