Check Point Finds Two High Risk Flaws in Popular LiteLLM AI Gateway

What Check Point found

The two issues are tracked as CVE-2026-35029 and CVE-2026-59823. According to Check Point Research, each one on its own gave an attacker with a basic user account a path to the most sensitive assets in an organization's AI stack.

LiteLLM is widely deployed. Check Point cites 97 million downloads per month and over 59,000 GitHub stars, and says the gateway runs inside large enterprises, startups and many of the platforms used to build AI applications.

• CVE-2026-35029 is an access control flaw that let low privileged users, including those with read only access, perform administrative actions. This led to full system takeover.
• CVE-2026-59823 is a server side request forgery (SSRF) flaw that let users redirect the gateway's outbound requests, exposing AI provider API keys.

In practical terms, Check Point says, anyone holding an account on a vulnerable LiteLLM deployment could take over the gateway and use it for malicious purposes.

How the attacks worked

LiteLLM uses role based access control, where administrators manage the system and other users receive limited or read only access. Because of CVE-2026-35029, users with minimal privileges could reach administrative functions controlling the gateway's core configuration. From there, Check Point says an attacker could read files on the server, including configuration and system files with sensitive information, overwrite administrator credentials and lock legitimate administrators out, or instruct the gateway to download and execute code from an external source. That last step could enable malware installation, data exfiltration or movement to other systems on the network. Check Point Research demonstrated each of these outcomes in a controlled test environment.

CVE-2026-59823 allowed any gateway user to direct LiteLLM to send API requests to a server under the attacker's control. By supplying a malicious destination within a request, the attacker caused the gateway to create a new route to their own server without validating it. The redirected requests carried the API keys LiteLLM uses to authenticate with AI providers, delivering those credentials to the attacker.

For affected organizations, Check Point lists theft of API keys without any compromise of OpenAI, Anthropic or other providers, unauthorized use of AI provider accounts, and unexpected costs billed to the organization.

Why a gateway flaw matters

An LLM gateway is the layer through which every request from an organization's applications travels on its way to an AI provider. According to Check Point, that position makes LiteLLM responsible for storing API keys for every provider in use, managing user access through roles and permissions, routing prompts and responses, and tracking usage and costs across models.

The credentials a gateway holds provide direct, billable access to AI providers with no further authentication required. Given LiteLLM's adoption, Check Point says a flaw in this component could affect a very large number of AI deployments at once.

Fix and recommended steps

Check Point reported both vulnerabilities to LiteLLM through a coordinated disclosure process that began in October 2025. LiteLLM resolved both in version 1.83.9, and all later versions include the fixes. Organizations running earlier versions are exposed to both flaws.

Check Point also notes that LiteLLM may be present indirectly, since it is embedded in many platforms and internal tools used to build AI applications, and may run in environments where it was never deployed as a standalone product. Its recommendations for users are:

• Update to LiteLLM 1.83.9 or above in every environment where the gateway runs.
• Review who has access to the gateway, and remove accounts that are no longer needed, since any account could be used to exploit the flaws.
• Rotate AI provider API keys stored in LiteLLM if there is any indication unauthorized users accessed the gateway before patching.
• Verify that users with limited roles are actually limited in practice.
• Include LLM gateways in penetration tests and vulnerability assessments, alongside web applications and cloud infrastructure.

What it means for AI infrastructure security

Check Point points out that both vulnerabilities belong to well understood classes of security error. In its view, this shows AI infrastructure is now exposed to the same risks that enterprise software has faced for years. As tools like LiteLLM gain adoption at speed, the company says attackers are paying close attention, and organizations need to secure their AI gateways with the same rigor they apply to any other business critical system.