♫Why♥Not♪ (@Python_s_) on X

What it is

CVE-2026-35029 (CVSS v4.0 8.7, High) is an authorization bypass in LiteLLM Proxy. A low-privilege authenticated user can reach the admin-only /config/update endpoint. The post is a security-alert digest of Check Point Research's October 13, 2026 write-up, not the primary source. It links the Check Point article and the BerriAI GitHub advisory, both truncated in the fetched text.

Preconditions / Affected

• Affected: LiteLLM Proxy before 1.83.0.
• The attacker needs a valid low-privilege account on the gateway.
• Check Point's demonstrated code execution ran against LiteLLM 1.77.7.

What to do

• Upgrade to 1.83.9 or later. The affected range ends at 1.83.0, but the post names 1.83.9 as the target. It does not explain the gap, so use 1.83.9+ rather than stopping at 1.83.0.
• Restrict network access to the gateway.
• Audit administrative configuration.
• Rotate credentials that may have been exposed, if compromise is suspected.
• Hunt for:
• non-admin POSTs to /config/update
• unauthorized environment-variable changes
• unexpected pass-through endpoints
• suspicious S3/GCS module loading

Caveats

• Exploitation status is a confirmed research PoC only. The post says there is no independently confirmed malicious in-the-wild exploitation.
• The vulnerability was first disclosed in April 2026. October 13 adds the full execution chain, which uses attacker-controlled Python modules hosted in cloud storage. A public chain makes exploitation easier, so treat this as higher urgency than the April disclosure suggested.
• The post gives no log field names, queries or commands, only the indicator categories above.