Organizations relying on LiteLLM AI gateway are under active risk from a serious security flaw in its admin API. Tracked as CVE-2026-35029, this vulnerability affects all LiteLLM versions before 1.83.0. It permits authenticated users without administrative privileges to invoke the /config/updateendpoint, which should have been restricted. This oversight allows low-privilege roles—such as proxy_admin_viewer—to push configuration changes only administrators should perform. LiteLLM patched this issue in version 1.83.0 by enforcing that only the proxy_adminrole may update configurations.
Methods of Exploitation
Adversaries have already exploited this flaw to access critical environment variables and alter configuration settings. One method involves changing the UI_LOGO_PATHto point to sensitive files such as /app/.envor /proc/self/environ, and then requesting the altered file via the /get_imageendpoint. In many susceptible deployments, that endpoint lacks authentication, making sensitive values—API keys, LiteLLM master keys, database credentials, AWS secrets, and observability tokens—vulnerable to exposure.
The bug also enables attackers to modify environment variables like UI_USERNAMEand UI_PASSWORDto seize control of the dashboard. Beyond credential theft, threat actors have been observed registering malicious pass-through endpoint handlers, which can lead to remote code execution or further data exfiltration.
Observed Attack Activity
Between February and June 2026, honeypot telemetry revealed around 3,900 probes targeting LiteLLM admin APIs, including about 1,000 specifically against the vulnerable /config/updateroute. The earliest probing followed just one day after the public disclosure of CVE-2026-35029 on April 6, 2026. Attackers were seen attempting to load files like /app/.env, /home/litellm/.env, /app/config.yaml, and /app/proxy_server_config.yaml. Other actions included generating new keys, enumerating users, deleting models, and probing SCIM provisioning endpoints.
Mitigation and Recommendations
Any organization running LiteLLM versions earlier than 1.83.0 should upgrade immediately. The patch introduces proper authorization checks for configuration updates. Further defenses include removing LiteLLM control planes from direct internet exposure, placing admin UIs behind authenticated reverse proxies or keeping them within private networks, and ensuring strong, unique master keys are used rather than defaults or examples.
Operationally, security teams must monitor logs for suspicious activity, especially calls to /config/update, /get_image, /key/generate, /user/new, /model/delete, and /scim/. Particular attention should be paid to attempts that change UI_LOGO_PATHto file paths that are likely sensitive. Additionally, if the vulnerable version has been exposed, rotate all secrets that may have been compromised—API keys, master keys, credentials, and tokens.
This flaw underscores the essentials of API authorization in AI infrastructure. As enterprises increasingly depend on AI gateway platforms that store high-value secrets, even a seemingly small oversight like missing role checks can open the door for full system compromise. What happens with LiteLLM is likely a warning for all vendors in the AI stack: strong permissions, defense-in-depth, and minimal exposure are non-negotiable.
