CVE-2026-35029 describes a vulnerability in LiteLLM, an AI Gateway proxy server component used by Red Hat OpenShift AI and other Red Hat products. The flaw is a missing authorization check on the /config/update endpoint, allowing an authenticated user to bypass access controls. Exploitation permits modification of proxy configurations and environment variables, which can lead to remote code execution, unauthorized file access, and privilege escalation. The vulnerability is rated as important/high severity by Red Hat, with a CVSS base score of 8.8 (per Red Hat and NVD). Affected versions include Red Hat OpenShift AI prior to 2.25.8. Red Hat has released updated images for version 2.25.8 to mitigate this issue. No known exploits in the wild have been reported. Mitigation guidance includes limiting network access to the LiteLLM service to trusted networks or hosts.

An authenticated user can exploit this vulnerability to bypass authorization controls on the LiteLLM proxy server's configuration endpoint. This allows modification of proxy settings and environment variables, potentially leading to remote code execution on the server, unauthorized reading of sensitive files, and takeover of privileged accounts. The impact includes confidentiality, integrity, and availability compromise of affected systems running vulnerable versions of Red Hat OpenShift AI and related products.

Red Hat has released updated images for Red Hat OpenShift AI version 2.25.8 that address this vulnerability. Users should upgrade to version 2.25.8 or later to fully remediate the issue. Until the update is applied, it is recommended to limit network access to the LiteLLM service by restricting inbound connections to trusted hosts or networks only, thereby reducing exposure of the vulnerable /config/update endpoint. Follow Red Hat's official upgrade documentation for proper cluster update procedures.