CVE-2026-35029 LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint
Authenticated users can modify proxy configuration to execute arbitrary code, read files, and take over accounts due to missing admin authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-35029?
CVE-2026-35029 is a high-severity missing authorization vulnerability in BerriAI litellm, published on 6 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to modify proxy configuration and environment variables, register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution, read arbitrary server files by setting UI_LOGO_PATH and fetching via /get_image, and take over other privileged accounts by overwriting UI_USERNAME and UI_PASSWORD environment variables. Fixed in v1.83.0.
Which versions are affected by CVE-2026-35029?
3 open source packages ship an affected version, including litellm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
litellm PyPI | All versions | 1.83.0 |
litellm PyPI | All versions | 1.83.0 |
litellm PyPI | All versions | 1.83.0 |
Products include Litellm Litellm.
How do I fix CVE-2026-35029?
Upgrade litellm to 1.83.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-35029 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-35029 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in BerriAI litellm
Sources
Also known as CLEANSTART-2026-EM91124, ECHO-f909-9693-1f3f, GHSA-53mr-6c8q-9789, MINI-2rwg-cq7w-wc9v, MINI-4pjf-mrrv-cpgh, MINI-cvx3-55p8-mpgf and 3 more.