{"answers":{"affected":"3 open source packages ship an affected version, including litellm. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-35029 exists.","fix":"Upgrade litellm to 1.83.0 or later.","what":"CVE-2026-35029 is a high-severity missing authorization vulnerability in BerriAI litellm, published on 6 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-35029 and fix it if it is affected.\n\nWhat it is: CVE-2026-35029 is a high-severity missing authorization vulnerability in BerriAI litellm, published on 6 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-35029 exists.\n\nAffected packages and fixed versions:\n- litellm (PyPI): affected all versions; fixed in 1.83.0\n- litellm (PyPI): affected all versions; fixed in 1.83.0\n- litellm (PyPI): affected all versions; fixed in 1.83.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-35029/ (Markdown: https://insights.sbomify.com/CVE-2026-35029/index.md)","id":"CVE-2026-35029","markdown":"https://insights.sbomify.com/CVE-2026-35029/index.md","name":"CVE-2026-35029","record":{"aliases":["CLEANSTART-2026-EM91124","ECHO-f909-9693-1f3f","GHSA-53mr-6c8q-9789","MINI-2rwg-cq7w-wc9v","MINI-4pjf-mrrv-cpgh","MINI-cvx3-55p8-mpgf","MINI-mcqq-966p-r7m3","MINI-x4mw-v99r-hpjm","PYSEC-2026-2597"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["code_execution","privilege_escalation","data_read","account_takeover"],"network_reachable":"yes","non_default_config":false,"product_category":"AI Gateway Proxy","requires_auth":"low_privilege","summary":"Authenticated users can modify proxy configuration to execute arbitrary code, read files, and take over accounts due to missing admin authorization checks.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"litellm","vendor":"litellm"}],"cvss":{"score":8.7,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N","version":"4.0"},"cwes":[{"id":"CWE-425","name":"Direct Request"},{"id":"CWE-863","name":"Incorrect Authorization"}],"description":"LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to modify proxy configuration and environment variables, register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution, read arbitrary server files by setting UI_LOGO_PATH and fetching via /get_image, and take over other privileged accounts by overwriting UI_USERNAME and UI_PASSWORD environment variables. Fixed in v1.83.0.","ecosystems":["PyPI"],"exploits":{"exploitdb":0,"first_seen":"2026-05-19","github_poc":1,"max_poc_stars":0,"metasploit":0,"nuclei":1,"refs":[{"date":"2026-05-19T14:02:18Z","kind":"github_poc","ref":"https://github.com/learner202649/CVE-2026-35029-PoC","stars":0,"title":"The code for personally reproducing the corresponding vulnerability"},{"date":null,"kind":"nuclei","ref":"http/cves/2026/CVE-2026-35029.yaml","stars":null,"title":"LiteLLM - Arbitrary File Read"}],"tier":"weaponised"},"has_fix":true,"headline":"LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint","id":"CVE-2026-35029","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":3,"n_references":1,"next":{"headline":"LiteLLM has an authentication bypass via OIDC userinfo cache key collision","id":"CVE-2026-35030"},"packages":[{"ecosystem":"PyPI","fixed":["1.83.0"],"introduced":["0"],"last_affected":[],"package":"litellm","purl":null,"source":"GHSA-53mr-6c8q-9789"},{"ecosystem":"PyPI","fixed":["1.83.0"],"introduced":["0"],"last_affected":[],"package":"litellm","purl":"pkg:pypi/litellm","source":"GHSA-53mr-6c8q-9789"},{"ecosystem":"PyPI","fixed":["1.83.0"],"introduced":["0"],"last_affected":[],"package":"litellm","purl":"pkg:pypi/litellm","source":"PYSEC-2026-2597"}],"prev":{"headline":"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","id":"CVE-2026-35028"},"products":["litellm"],"published":"2026-04-06","related":[{"cvss_score":9.3,"headline":"BerriAI LiteLLM SQL Injection","id":"CVE-2026-42208","kev_date_added":"2026-05-08","published":"2026-05-08"},{"cvss_score":8.8,"headline":"BerriAI LiteLLM Improper Authentication","id":"CVE-2026-59822","kev_date_added":"2026-09-02","published":"2026-07-08"},{"cvss_score":8.7,"headline":"BerriAI LiteLLM Command Injection","id":"CVE-2026-42271","kev_date_added":"2026-06-08","published":"2026-05-08"},{"cvss_score":9.8,"headline":"Remote Code Execution in BerriAI/litellm","id":"CVE-2024-5751","kev_date_added":null,"published":"2024-06-27"},{"cvss_score":9.8,"headline":"Server-Side Template Injection in BerriAI/litellm","id":"CVE-2024-2952","kev_date_added":null,"published":"2024-04-10"},{"cvss_score":9.5,"headline":"LiteLLM: Authentication Bypass via Host Header Injection","id":"CVE-2026-49468","kev_date_added":null,"published":"2026-06-22"},{"cvss_score":9.4,"headline":"LiteLLM has an authentication bypass via OIDC userinfo cache key collision","id":"CVE-2026-35030","kev_date_added":null,"published":"2026-04-06"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"attribution","licence":"MIT","name":"Nuclei templates"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-07-15","vendors":["BerriAI"]},"summary":"Authenticated users can modify proxy configuration to execute arbitrary code, read files, and take over accounts due to missing admin authorization checks.","url":"https://insights.sbomify.com/CVE-2026-35029/"}