Security flaws found in top open source AI gateway — LiteLLM vulnerabilties could affect millions of users

Two LiteLLM flaws let low-privileged users gain administrative control and execute malicious code Attackers could also steal AI provider API keys through a server-side request forgery bug Organizations should upgrade to LiteLLM 1.83.9+ and rotate potentially exposed credentials Security researchers recently discovered two vulnerabilities in a popular AI gateway that allowed threat actors to take complete control of the system, steal sensitive files and AI provider API keys, and execute malicious code remotely.

The AI gateway in question is called LiteLLM.

It is an open source solution allowing users to connect their applications to large language models (LLM) from different providers, including the likes of OpenAI and Anthropic.

The connection goes through a single interface, where users can route requests, manage API keys, control user access, and monitor things like usage and costs.

Right now, LiteLLM supports some 140 AI providers and has become quite popular - it has more than 90 million monthly downloads on GitHub, and more than 61,000 stars.

LiteLLM However, security experts from Check Point Research (CPR) recently found two bugs in LiteLLM.

The first one is an access control bug in the way LiteLLM enforces permissions.

It is tracked as CVE-2026-35029 and was given a severity score of 8.7/10 (high).

According to CPR, the bug allows users with minimal privileges to reach admin functions controlling the gateway’s core configuration which, in turn, allows them to read files stored on the server, overwrite admin credentials, download and run malware, and more.

The second one is a server side request forgery bug, allowing gateway users to direct LiteLLM to send API requests to third-party servers.

In theory, threat actors could send API requests to servers under their own control, and since these carry AI provider authentication keys, this would deliver the credentials directly to the attackers.

In turn, they could use the credentials to use other organizations’ AI accounts and rake up their bills.

The bug is tracked as CVE-2026-59823 and was given a severity score of 5.3/10 (medium).

“The credentials a gateway holds provide direct, billable access to AI providers with no further authentication required,” CPR explained.