CVE-2026-35029: LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint
Impact
The /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to do the following:
- Modify proxy configuration and environment variables - Register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution - Read arbitrary server files by setting UILOGOPATH and fetching via /getimage - Take over other priveleged accounts by overwriting UIUSERNAME and UIPASSWORD environment variables
Patches
Fixed in v1.83.0. The endpoint now requires proxyadmin role.
Workarounds
Restrict API key distribution. There is no configuration-level workaround.
Other sources
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to modify proxy configuration and environment variables, register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution, read arbitrary server files by setting UILOGOPATH and fetching via /getimage, and take over other privileged accounts by overwriting UIUSERNAME and UIPASSWORD environment variables. Fixed in v1.83.0.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/litellmto a version that resolves this vulnerability.Fixed in 1.83.0 - Upgrade
Upgrade
LiteLLMto a version that resolves this vulnerability.Fixed in 1.83.0 - Configuration
Update LiteLLM so the /config/update endpoint enforces admin authorization by requiring the proxy_admin role.
LiteLLM /config/update endpoint authorization = Require proxy_admin role - Compensating control
Restrict API key distribution, since /config/update lacked admin-role authorization prior to v1.83.0.