LiteLLM Flaw Hits 90M Downloads: Patch Now to 1.83.9

What is the LiteLLM vulnerability and which versions are affected?

LiteLLM is an open-source gateway that connects apps to more than 140 AI providers, including OpenAI and Anthropic, through one interface. Every version before 1.83.9 carries two vulnerabilities: one rated high and one medium. The patch landed in 1.83.9.

Check Point Research found two separate errors in LiteLLM's authorization logic and its request routing. LiteLLM is widely used in AI infrastructure, with more than 90 million monthly downloads and over 61,000 GitHub stars.

The first flaw is tracked as CVE-2026-35029 and scores 8.7/10, a high severity rating. The second, CVE-2026-59823, scores 5.3/10, medium severity. Both were closed in version 1.83.9.

How is the LiteLLM flaw exploited?

CVE-2026-35029 lets a low-privilege user reach admin functions, so an attacker can read server files, change admin credentials and run malicious code. CVE-2026-59823 uses server-side request forgery (SSRF) to redirect AI provider API keys to an attacker-controlled server.

According to Check Point Research, the access control error comes from a gap between configuration and enforcement. A low-privilege account can change the gateway's core configuration, which can escalate to full system takeover.

The second flaw is a server-side request forgery bug. LiteLLM can forward a user request to a third-party server, and because those requests carry AI provider keys, the credentials go straight to the attacker.

• A low-privilege user reaches admin functions.
• Sensitive files on the server can be read.
• Admin credentials can be changed.
• Malicious code can be downloaded and executed.
• Stolen API keys can inflate another organization's bill.

What should you do about the LiteLLM vulnerability?

Update LiteLLM to version 1.83.9 or later first. Then review every account with gateway access, rotate all AI provider API keys and verify that configured permissions are actually enforced in practice.

Check Point Research recommends checking not only standalone installs but also LiteLLM instances embedded inside other platforms. The gateway often runs in the background of AI applications, so some deployments go unnoticed.

When you audit permissions, confirm that the role shown in the configuration is the role enforced at runtime. The worst damage from CVE-2026-35029 appears in that gap between configured and applied permissions.

1. Upgrade LiteLLM to 1.83.9 or later.
2. List every account with gateway access and remove the ones you do not need.
3. Rotate AI provider API keys immediately.
4. Search your inventory for embedded LiteLLM instances.
5. Add AI gateways to your penetration testing scope.

Does the LiteLLM vulnerability affect AI projects outside the US?

Yes. Any team running LiteLLM — chatbots, internal AI tools or enterprise integrations — faces the same risk, because the gateway is used worldwide for routing requests to OpenAI, Anthropic, Google and local models. Many teams may not know the flaw affects them.

LiteLLM is popular because it connects OpenAI, Anthropic, Google and self-hosted models through a single interface. That same convenience puts startups and enterprise teams everywhere on the same risk list.

If keys are stolen, attackers can run up large bills on the organization's AI account. Until the patch is applied, monitoring gateway traffic and reviewing suspicious requests is a sensible stopgap.

Bottom line

Two LiteLLM vulnerabilities put an AI gateway with more than 90 million downloads at risk. To apply the fix, move to version 1.83.9 or later, rotate your API keys and review every account with gateway access. Do not forget embedded installs — in unnoticed instances the flaw can stay open for months. Teams that also rely on third-party AI agents should treat this as a reminder that supply-chain security is now a daily job, not a one-off audit.