Security researchers have uncovered two high-risk vulnerabilities in LiteLLM, a widely used open source AI gateway that connects applications to large language models from providers such as OpenAI and Anthropic. The flaws could allow attackers to seize administrative control of the gateway, execute malicious code and steal sensitive API keys, according to a report from Check Point Research (CPR).

What You Need to Know

LiteLLM is an open source gateway that routes requests to over 140 AI providers, including OpenAI and Anthropic. It has more than 90 million monthly downloads on GitHub. The two vulnerabilities, tracked as CVE-2026-35029 and CVE-2026-59823, affect all versions before 1.83.9. Organizations using LiteLLM, even indirectly through embedded tools, should upgrade immediately and rotate any potentially exposed API keys.

Inside the LiteLLM Vulnerabilities

The first flaw, CVE-2026-35029, is an access control bug that lets users with minimal privileges reach admin functions. This allows them to read files on the server, overwrite admin credentials and download and run malware. It carries a severity score of 8.7 out of 10.

The second flaw, CVE-2026-59823, is a server-side request forgery bug. It enables gateway users to direct LiteLLM to send API requests to third-party servers. Because these requests carry AI provider authentication keys, attackers could send them to servers under their control and capture the credentials. The bug has a severity score of 5.3 out of 10.

According to CPR, the credentials a gateway holds provide direct, billable access to AI providers with no further authentication required. Given LiteLLM's scale of adoption, a flaw in this component has the potential to affect a very large number of AI deployments at once.

Why This Matters

The discovery highlights a growing risk in AI infrastructure: gateways like LiteLLM are becoming single points of failure for organizations that rely on multiple AI providers. A breach here does not just expose one system; it can hand attackers the keys to an organization's entire AI spending and data access. For businesses, the immediate concern is financial: stolen API keys can be used to run up bills on services like OpenAI. The longer-term impact is reputational and operational, as attackers could pivot from the gateway into other internal systems. Security teams must now treat AI gateways with the same rigor as any other business-critical system, extending penetration tests and vulnerability assessments to cover AI tooling alongside web applications and cloud infrastructure.

What You Need to Know

  • Vulnerable versions: All LiteLLM versions earlier than 1.83.9 are affected by both flaws.
  • Patch available: LiteLLM 1.83.9 fixes both bugs. Organizations should upgrade as soon as possible.
  • Rotate credentials: If unauthorized access is suspected, rotate all AI provider API keys stored in LiteLLM.
  • Check indirect deployments: LiteLLM is embedded in many platforms and internal tools, so it may be present even if not deployed standalone.

Immediate Steps for Security Teams

CPR advises organizations to review who has access to the gateway, since any account could be used to exploit these flaws. Permissions should be verified in practice, not just in configuration. The gap between configured and enforced permissions is where flaws like CVE-2026-35029 cause the most damage.

Security teams should also include LLM gateways in their security assessments. This means extending penetration tests and vulnerability assessments to cover AI tooling alongside web applications and cloud infrastructure.

The Broader AI Security Challenge

Both bugs belong to a well-understood class of errors, according to the researchers. This means AI infrastructure suffers from the same risks as enterprise software. The incident underscores that as AI adoption accelerates, the security of the underlying plumbing becomes paramount. LiteLLM's popularity, with more than 61,000 stars on GitHub, makes it an attractive target for attackers. Organizations must therefore approach AI gateway security with the same rigor they apply to any other business-critical system.