Critical Flaws Found in LiteLLM Gateway Used to Connect AI Apps to OpenAI and Others

What is LiteLLM and why do companies use it?

LiteLLM is an open-source gateway tool that helps organisations connect their applications to large language model (LLM) providers such as OpenAI, Google and Anthropic. Instead of each app connecting directly to an AI provider, requests go through LiteLLM, which manages credentials, logging and usage tracking. This centralises control and makes it easier for companies to manage access to AI services.

LiteLLM is widely used, with nearly 100,000 downloads a month, according to Infosecurity Magazine↗ (opens in a new tab). Many enterprises rely on it to build and run AI-powered services.

The vulnerabilities: what was found?

Cybersecurity researchers at Check Point discovered two serious vulnerabilities in LiteLLM, tracked as CVE-2026-35029 and CVE-2026-59823. Both flaws affect versions older than 1.83.9. The main risk is that any user with an account on a vulnerable LiteLLM system could gain administrative access. This could allow them to take control of the gateway, access files, steal login credentials, and even run their own code on the system.

CVE-2026-35029 is due to a missing authorisation check. This means a user with limited permissions could change important settings and potentially load malicious code from cloud storage. CVE-2026-59823 is a server-side request forgery (SSRF) flaw, which could let an attacker redirect the gateway’s outgoing requests and expose sensitive API keys for AI providers.

What could attackers do?

If exploited, these vulnerabilities could let attackers:

• Take over the LiteLLM gateway
• Access or steal API keys for AI providers
• Run malicious code on the system
• Access files and potentially sensitive data

Because LiteLLM often stores credentials for multiple AI providers and manages user roles, a compromise could have wide-reaching effects inside an organisation.

What has been done and what should users do?

Check Point reported the flaws to LiteLLM through a coordinated disclosure process. The vulnerabilities are fixed in version 1.83.9 and later. Users are strongly urged to update to the latest version as soon as possible.

Experts recommend several steps to reduce risk:

• Audit who has access to your LiteLLM gateway and remove unused accounts
• Rotate API keys if there is any sign of unauthorised access
• Check that user permissions are enforced as expected
• Include LLM gateways in regular security assessments and penetration tests

Christopher Jess, a senior manager at Black Duck, noted that these are common application security issues, and that centralising AI access makes such gateways especially attractive targets.

What is still unclear?

So far, only Infosecurity Magazine↗ (opens in a new tab) has reported these findings. There is no statement yet from LiteLLM, OpenAI, or any government agency. It is not clear if these vulnerabilities have been exploited in the wild. Organisations using LiteLLM should monitor for further updates and advisories from the vendor.

What you should do next

If your organisation uses LiteLLM, check your version and update to 1.83.9 or later. Review user accounts and permissions, and rotate API keys if you suspect any compromise. Make sure your security testing covers AI infrastructure, not just traditional web and cloud systems.