Do Son 
TL;DR
Honeypot sensors recorded thousands of unauthorized requests targeting a severe LiteLLM vulnerability tracked as CVE-2026-35029. This critical broken access control flaw allows attackers to read sensitive files and achieve a full server takeover. System administrators must upgrade exposed AI gateways to version 1.83.0 immediately.
- CVE: CVE-2026-35029
- CVSS: 8.8 (High · CVSSv3)
- Product: BerriAI litellm
- Affected: < 1.83.0
- Impact: LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint
- Status: Exploited in the wild
- EPSS: 19.4% (30-day)
- Action: See vendor advisory
Why It Matters
AI gateways act as central conduits for enterprise artificial intelligence models and data pipelines. According to researchers, “An AI gateway like LiteLLM holds the keys to everything behind it: the API keys for every model provider, the database of users and spend, and the admin login itself.” Therefore, compromising this control plane exposes vital API credentials, cloud tokens, and database connection strings.
Threat intelligence confirms active exploitation in the wild. Attackers launched automated scans against exposed admin endpoints immediately after public disclosure. Honeypot telemetry recorded roughly 3,900 requests from 73 distinct IP addresses targeting administrative routes. As detailed in the Zenity Labs security report, malicious actors actively probed configuration routes to extract environment variables. Consequently, an unpatched LiteLLM vulnerability poses immediate operational danger to organizations utilizing large language models.
How the Attack Works
The security flaw stems from missing authorization checks on the administrative /config/update route. Under default settings or read-only roles, unauthenticated or low-privilege users can modify server configurations. The application treats configuration parameters as dynamic variable references rather than static strings.
Attackers exploit this flaw by sending a JSON payload to modify the UI_LOGO_PATH parameter. They direct this path to sensitive local files, such as /app/.env or /proc/self/environ. Next, the attacker issues a simple GET request to the unauthenticated /get_image endpoint. The server reads the file off the disk and returns the plaintext contents to the client.
Furthermore, attackers can overwrite the administrator credentials directly through configuration updates. By modifying UI_USERNAME and UI_PASSWORD parameters, threat actors log into the dashboard with full administrative permissions. Intruders also attempt to register malicious pass-through proxy routes. These malicious routes forward internal model requests and exfiltrate resolved API secrets directly to attacker-controlled servers.
Affected Versions
This critical security flaw impacts multiple releases of the LiteLLM proxy:
- All LiteLLM versions prior to 1.83.0
- Deployments running default, weak, or missing master key settings
Patch or Mitigation Steps
The LiteLLM development team resolved CVE-2026-35029 by releasing version 1.83.0. Organizations must update their proxy installations to version 1.83.0 or later without delay.
Additionally, administrators must configure unique master keys for all production gateways. Teams should never deploy instances with default credentials like sk-1234. Furthermore, security engineers should restrict administrative routes from public internet access. Placing the gateway control plane behind a trusted VPN or private subnet prevents unauthorized exploitation attempts.
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
