CHECK Point Research’s assessment, published on 13 October 2026, scrutinised LiteLLM v1.77.7, a popular open‑source LLM gateway. They identify several high‑severity flaws that could enable attackers to bypass access controls, read arbitrary files, seize administrative control, and even achieve remote code execution. The core issue is missing function‑level authorization on POST /config/update, combined with an overly permissive route allowlist for UI sessions.
This permitted an unauthorised user to alter the proxy’s runtime configuration and inject environment variables that the gateway would decrypt and apply. The report ties these weaknesses to CVE‑2026‑35029 (missing authorization in /config/update) and CVE‑2026‑59823 (server‑side request forgery via user_config), with additional disclosure around password handling (GHSA entries).
The paper details concrete exploitation paths: arbitrary file read via environment variable injection (notably UI_LOGO_PATH influencing /get_image), and even administrative account takeover by overwriting UI credentials (UI_USERNAME/UI_PASSWORD) through /config/update. It further describes remote code execution possibilities through pass‑through endpoints that load Python modules from remote storage (s3:// or gcs://), where top‑level code execution occurs during module loading.
A separate SSRF risk is highlighted through Clientside LLM Credentials, enabling attacker‑controlled routing of LLM calls to exfiltrate keys. The authors present proofs of concept and demonstrate an immediate impact scenario, including that a single vulnerable endpoint can cascade into full gateway compromise. LiteLLM maintainers reportedly addressed these flaws by version 1.83.9, though the report emphasises ongoing need for robust access control and strict input validation in AI infrastructure tools.