When LLM Gateways Go Wrong: Findings from LiteLLM

LiteLLM (v1.77.7) contained multiple high-severity vulnerabilities, including CVE-2026-35029 and CVE-2026-59823, which have been resolved in version 1.83.9. The primary flaw was a missing authorization check on the /config/update endpoint. This allowed authenticated users with low privileges to modify the proxy's runtime configuration via environment variable injection, leading to arbitrary file reads, administrative account takeover, and remote code execution through the loading of malicious Python modules from cloud storage.
Additionally, a Server-Side Request Forgery (SSRF) vulnerability existed within the "Clientside LLM Credentials" feature, enabling attackers to redirect API calls and exfiltrate provider keys. Further weaknesses included the exposure of password hashes to authenticated users and the use of insecure, single-iteration hashing without salts. These vulnerabilities highlight a tension between the rapid deployment of AI infrastructure and the application of foundational security practices like role-based access control and secure credential storage.

* LiteLLM version 1.77.7 contained vulnerabilities CVE-2026-35029 and CVE-2026-59823.
* LiteLLM version 1.83.9 resolves these vulnerabilities.
* The /config/update endpoint lacked a role-based access control (RBAC) check.
* UI session tokens were assigned to the "litellm-dashboard" team.
* The isuiroute function used startswith matching for the "/config" route.
* The UILOGOPATH environment variable could be modified to read local files via /getimage.
* The UIUSERNAME and UIPASSWORD environment variables could be modified to hijack the admin account.
* Pass-through endpoints allowed loading Python modules from s3:// and gcs:// URLs via importlib.
* The userconfig parameter in /chat/completions allowed custom apibase URLs.
* Password hashes were accessible to authenticated users through API endpoints.
* Password hashing utilized a single iteration without salting.

The strongest version of this narrative is a technical post-mortem demonstrating how "modern" AI middleware often neglects "ancient" security fundamentals. By chaining a simple routing error (startswith matching) with environment variable injection, a low-privileged user can escalate to full system compromise.
The analysis follows a logical progression from a minor access control leak to total RCE, effectively illustrating the "Swiss Cheese" model of failure. However, the narrative frames these failures as a "concerning trend" in the AI ecosystem, suggesting a systemic trade-off where speed of innovation replaces foundational security.
Root Cause: The driving paradigm is the "Move Fast and Break Things" ethos applied to infrastructure. The unstated assumption is that because the tools are new, the failure modes will be new; in reality, these are classic OWASP-style vulnerabilities (Broken Access Control, Insecure Design) appearing in a new context.
Implications: The cost is borne by the end-user and the organization deploying the gateway, which becomes a single point of failure for all LLM credentials. This centralizes risk while decentralizing security responsibility.
Bridge Questions:
1. Does the rapid adoption of "wrappers" and "gateways" create a new class of systemic risk that traditional security audits aren't equipped to find?
2. To what extent does the open-source nature of these tools accelerate both their adoption and the discovery of these critical flaws?
Counterstrike Scan: A coordinated campaign would use these technical findings to manufacture a "crisis of trust" in open-source AI tools to push proprietary, "hardened" alternatives. The actual content is a technical disclosure and does not match this pattern.
Patterns detected: none