CVE-2026-35029: LiteLLM Proxy Server RCE Vulnerability

CVE-2026-35029 Overview

CVE-2026-35029 is an authorization bypass vulnerability in LiteLLM, an AI Gateway proxy server used to call LLM APIs in OpenAI (or native) format. Prior to version 1.83.0, the /config/update endpoint does not enforce admin role authorization, allowing authenticated users to modify proxy configurations and environment variables. This vulnerability enables attackers to achieve remote code execution, read arbitrary server files, and take over privileged accounts.

Critical Impact

Authenticated users can escalate privileges to achieve remote code execution, read sensitive server files, and compromise admin accounts through configuration manipulation.

Affected Products

• LiteLLM versions prior to 1.83.0
• LiteLLM AI Gateway proxy server deployments
• Self-hosted LiteLLM instances with multi-user access

Discovery Timeline

• 2026-04-06 - CVE CVE-2026-35029 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-35029

Vulnerability Analysis

This vulnerability falls under CWE-863 (Incorrect Authorization), where the application fails to properly verify that a user has the required administrative privileges before allowing access to sensitive configuration endpoints. The /config/update endpoint in LiteLLM accepts authenticated requests without validating whether the requesting user possesses admin-level permissions.

The impact of this authorization bypass is severe, enabling multiple attack vectors. An attacker with basic authenticated access can manipulate the proxy configuration to their advantage. This includes the ability to register custom pass-through endpoint handlers that point to attacker-controlled Python code, effectively achieving remote code execution on the server.

Additionally, attackers can read arbitrary server files by setting the UI_LOGO_PATH configuration variable to target sensitive files and then fetching them via the /get_image endpoint. The vulnerability also permits account takeover by overwriting the UI_USERNAME and UI_PASSWORD environment variables, allowing attackers to gain access to privileged administrative accounts.

Root Cause

The root cause of this vulnerability is the absence of proper authorization checks on the /config/update endpoint. While the endpoint requires authentication (a valid user session), it fails to verify that the authenticated user has the necessary administrative role before processing configuration modification requests. This missing authorization check allows any authenticated user to perform actions that should be restricted to administrators only.

Attack Vector

The attack is network-based and requires low-complexity exploitation by an authenticated user. An attacker who has obtained valid credentials (even with minimal privileges) can directly interact with the vulnerable endpoint to:

1. Achieve Remote Code Execution: Register custom pass-through endpoint handlers pointing to attacker-controlled Python code, which will be executed by the server
2. Read Arbitrary Files: Modify UI_LOGO_PATH to point to sensitive files (such as /etc/passwd, configuration files, or secrets) and retrieve them via the /get_image endpoint
3. Account Takeover: Overwrite UI_USERNAME and UI_PASSWORD environment variables to gain administrative access to the LiteLLM interface

The vulnerability mechanism involves sending authenticated HTTP requests to the /config/update endpoint with malicious configuration parameters. Since the endpoint does not verify admin role membership, these requests are processed and applied to the system configuration. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-35029

Indicators of Compromise

• Unexpected modifications to LiteLLM configuration files or environment variables
• Unusual requests to the /config/update endpoint from non-admin user sessions
• Requests to /get_image endpoint with suspicious file paths outside expected directories
• New or modified pass-through endpoint handlers pointing to external or unexpected Python code sources
• Changes to UI_USERNAME, UI_PASSWORD, or UI_LOGO_PATH configuration values

Detection Strategies

• Monitor HTTP request logs for POST requests to /config/update from users without admin privileges
• Implement audit logging for all configuration changes and correlate with user role assignments
• Alert on requests to /get_image containing path traversal patterns or requests for non-image file types
• Review access logs for patterns indicating enumeration of configuration endpoints

Monitoring Recommendations

• Enable verbose logging on LiteLLM proxy server instances to capture all API requests and authentication details
• Configure SIEM rules to detect configuration modification attempts by non-privileged users
• Implement file integrity monitoring on LiteLLM configuration directories
• Set up alerting for any changes to authentication-related environment variables

How to Mitigate CVE-2026-35029

Immediate Actions Required

• Upgrade LiteLLM to version 1.83.0 or later immediately
• Audit existing LiteLLM configuration for unauthorized modifications
• Review user accounts and remove unnecessary access privileges
• Rotate administrative credentials (UI_USERNAME and UI_PASSWORD) as a precaution
• Check for any unexpected pass-through endpoint handlers and remove malicious entries

Patch Information

The vulnerability has been fixed in LiteLLM version 1.83.0. Organizations should update to this version or later to remediate the authorization bypass vulnerability. The patch introduces proper admin role authorization checks on the /config/update endpoint, ensuring only users with administrative privileges can modify proxy configurations. For additional details, consult the GitHub Security Advisory.

Workarounds

• Restrict network access to the /config/update endpoint using firewall rules or reverse proxy configurations
• Implement additional authentication layer (such as VPN or IP allowlisting) for administrative endpoints
• Disable or limit user registration if multi-user access is not required
• Deploy web application firewall rules to block unauthorized configuration modification attempts
• Consider running LiteLLM in single-user mode if multi-tenant access is not necessary

# Example: Restrict access to config endpoints via nginx reverse proxy
location /config/update {
    # Allow only from trusted admin IP addresses
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://litellm_backend;
}