CVE-2026-35029: CWE-863: Incorrect Authorization in BerriAI litellm
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to modify proxy configuration and environment variables, register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution, read arbitrary server files by setting UI_LOGO_PATH and fetching via /get_image, and take over other privileged accounts by overwriting UI_USERNAME and UI_PASSWORD environment variables. Fixed in v1.83.0.
AI Analysis
Technical Summary
LiteLLM, a proxy server for calling LLM APIs, has an authorization bypass vulnerability in the /config/update endpoint before version 1.83.0. Authenticated users without admin privileges can exploit this flaw to change proxy configuration and environment variables, register malicious pass-through endpoint handlers executing attacker-controlled Python code, read arbitrary server files by manipulating UI_LOGO_PATH, and overwrite UI_USERNAME and UI_PASSWORD environment variables to hijack privileged accounts. This vulnerability is tracked as CVE-2026-35029 with a CVSS 4.0 score of 8.7 (high severity). It is fixed in litellm version 1.83.0. Red Hat advisories reference this CVE and provide updates for affected products.
Potential Impact
An authenticated user without admin privileges can exploit this vulnerability to execute arbitrary code remotely, read sensitive files on the server, and take over privileged accounts by modifying environment variables. This compromises the confidentiality, integrity, and availability of the affected system.
Mitigation Recommendations
Upgrade litellm to version 1.83.0 or later, where the vulnerability is fixed. Red Hat advisories provide relevant patches and updates for affected distributions. Patch status is confirmed fixed in v1.83.0. No alternative mitigations are indicated in the vendor advisory.
CVE-2026-35029: CWE-863: Incorrect Authorization in BerriAI litellm
Description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to modify proxy configuration and environment variables, register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution, read arbitrary server files by setting UI_LOGO_PATH and fetching via /get_image, and take over other privileged accounts by overwriting UI_USERNAME and UI_PASSWORD environment variables. Fixed in v1.83.0.
CVSS v4.0
Score 8.7high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
LiteLLM, a proxy server for calling LLM APIs, has an authorization bypass vulnerability in the /config/update endpoint before version 1.83.0. Authenticated users without admin privileges can exploit this flaw to change proxy configuration and environment variables, register malicious pass-through endpoint handlers executing attacker-controlled Python code, read arbitrary server files by manipulating UI_LOGO_PATH, and overwrite UI_USERNAME and UI_PASSWORD environment variables to hijack privileged accounts. This vulnerability is tracked as CVE-2026-35029 with a CVSS 4.0 score of 8.7 (high severity). It is fixed in litellm version 1.83.0. Red Hat advisories reference this CVE and provide updates for affected products.
Potential Impact
An authenticated user without admin privileges can exploit this vulnerability to execute arbitrary code remotely, read sensitive files on the server, and take over privileged accounts by modifying environment variables. This compromises the confidentiality, integrity, and availability of the affected system.
Mitigation Recommendations
Upgrade litellm to version 1.83.0 or later, where the vulnerability is fixed. Red Hat advisories provide relevant patches and updates for affected distributions. Patch status is confirmed fixed in v1.83.0. No alternative mitigations are indicated in the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-31T21:06:06.427Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-35029","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:13545","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:28960","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:30056","vendor":"Red Hat"}]
Threat ID: 69d3ea320a160ebd92c9fda1
Added to database: 04/06/2026, 17:15:30 UTC
Last enriched: 07/15/2026, 09:04:30 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 173
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.