Attackers are actively exploiting a critical authorization flaw in LiteLLM’s administrative API. This vulnerability allows low-privileged, read-only users to modify proxy configurations, expose sensitive secrets, and potentially gain full administrator control over affected servers.
Researchers at Zenity Labs tracked approximately 3,900 requests targeting LiteLLM’s administration endpoints from February to June 2026, originating from 73 different IP addresses.
Nearly 1,000 of these requests specifically targeted the sensitive `/config/update` endpoint, with exploit patterns linked to CVE-2026-35029.
The vulnerability, disclosed on April 6, 2026, arises from a missing authorization check on the configuration update route. LiteLLM versions before 1.83.0 did not properly verify whether callers had administrator privileges before allowing changes to high-impact proxy settings. This issue was patched in LiteLLM version 1.83.0.
LiteLLM functions as an AI gateway that centralizes access to model-provider API keys, user and spending data, proxy configurations, and administrative credentials. Its control plane allows operators to create keys, configure models, set budgets, manage users, and update live settings.
This concentration of privileges makes the administrative API an attractive target. In the vulnerable configuration, a read-only account could invoke `/config/update` to modify settings that should be accessible only to administrators.
Researchers noted that attackers could exploit this flaw by changing the `UI_LOGO_PATH` setting, which controls the local file displayed as the dashboard logo.
If pointed to sensitive files such as `.env` files, configuration YAML files, or `/proc/self/environ`, the server may be able to read those files. The unauthenticated `/get_image` route could then expose their contents to a remote requester.
Potentially exposed data might include LiteLLM master keys, AI provider credentials, cloud access tokens, database connection strings, and observability platform secrets.
The same configuration write access can also lead to more serious takeover scenarios. LiteLLM resolves selected `os.environ/VARIABLE` references on the server, creating opportunities to extract environment-held secrets through operator-defined proxy routes.
An attacker who can modify dashboard login environment variables could potentially change the UI username and password, allowing them to authenticate as an administrator.
This would grant them broad access to generate API keys, create users, review spending and deployment data, alter models, or delete resources.
Zenity successfully reproduced this issue on LiteLLM version 1.74.0, demonstrating a complete attack chain using a read-only account, a mounted sensitive environment file, and an attacker-controlled collection service.
The first probes targeting `/config/update` were detected by researchers on April 7, just one day after the CVE was published. Later file-read payloads were observed between May 5 and May 12, targeting common secret locations including `/app/.env`, `/home/litellm/.env`, configuration files, and process environment data.
Additional observed activity included default master key guessing, attempts to create administrator users through `/user/new`, key-generation requests, API enumeration, model deletion attempts, and SCIM endpoint probing. Researchers also discovered JavaScript-style prototype pollution payloads, although these were ineffective against LiteLLM’s Python-based proxy.
Organizations running LiteLLM should upgrade to version 1.83.0 or later immediately. Administrators are advised to rotate all potentially exposed secrets, configure strong non-default master keys, restrict control plane access, and monitor requests to `/config/update`, `/get_image`, `/key/generate`, and `/user/new`.
This campaign highlights a broader risk associated with AI gateways: a seemingly limited account can lead to a full infrastructure compromise when authorization controls around configuration management fail.
Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…