Threat · curated 4 Sep 2026
CVE-2026-35029 Exploited for Full Server Takeover
First reported securityonline.info
Coverage timeline
Single-source incident — first reported, latest, and curated coincide.
Why it matters
CVE-2026-35029 hands attackers the keys to an enterprise AI control plane — every model provider API key, user database, and admin login — and is already under active exploitation, so unpatched LiteLLM gateways face immediate takeover.
CVE-2026-35029, a critical broken access control flaw in the LiteLLM AI gateway (versions before 1.83.0, CVSS 8.8), is being actively exploited to read sensitive files and achieve full server takeover. Attackers abuse the unauthenticated /config/update route to point UI_LOGO_PATH at files like /app/.env or /proc/self/environ and retrieve their plaintext contents via /get_image, and can overwrite admin credentials and register malicious pass-through proxy routes to exfiltrate model API secrets. Honeypot telemetry recorded roughly 3,900 requests from 73 distinct IPs targeting admin routes; the fix is version 1.83.0.
Summary
CVE-2026-35029 is a critical broken access control vulnerability in BerriAI LiteLLM, a widely used AI gateway/proxy. The flaw allows unauthenticated or low-privilege users to modify server configuration, read sensitive local files, overwrite administrator credentials, and ultimately achieve full server takeover. It carries a CVSS score of 8.8 (High) and an EPSS of 19.4%.[0]
The vulnerability is being exploited in the wild. Honeypot sensors recorded approximately 3,900 unauthorized requests from 73 distinct IP addresses targeting administrative endpoints shortly after public disclosure, with attackers probing configuration routes to extract environment variables. Because an AI gateway holds provider API keys, user/spend databases, and admin logins, compromise exposes the entire control plane behind it.[0]
All LiteLLM versions prior to 1.83.0 are affected, particularly deployments running default, weak, or missing master key settings. Organizations should upgrade to version 1.83.0 or later immediately.[0]
Attack chain
- Configuration modification via broken access control: Attackers exploit missing authorization checks on the administrative /config/update route, allowing unauthenticated or read-only-role users to modify server configuration. LiteLLM treats configuration parameters as dynamic variable references rather than static strings.[0]
- Arbitrary file read: Attackers send a JSON payload to modify the UI_LOGO_PATH parameter, pointing it at sensitive local files such as /app/.env or /proc/self/environ, then issue a GET request to the unauthenticated /get_image endpoint. The server reads the file and returns its plaintext contents.[0]
- Credential overwrite and admin access: Attackers overwrite administrator credentials by modifying the UI_USERNAME and UI_PASSWORD configuration parameters, then log into the dashboard with full administrative permissions.[0]
- Secret exfiltration via malicious proxy routes: Intruders register malicious pass-through proxy routes that forward internal model requests and exfiltrate resolved API secrets to attacker-controlled servers.[0]
Disclosure timeline
| Date | Event |
|---|---|
| After public disclosure | Attackers launched automated scans against exposed admin endpoints; honeypots recorded ~3,900 requests from 73 IPs targeting administrative routes.[0] |
| Not specified | LiteLLM development team released version 1.83.0 resolving CVE-2026-35029.[0][1] |
How it works
The root cause is missing authorization checks on the administrative /config/update route, which allows unauthenticated or low-privilege (read-only) users to modify server configuration under default settings. Because LiteLLM treats configuration parameters as dynamic variable references rather than static strings, an attacker can set UI_LOGO_PATH to a sensitive local file path (e.g. /app/.env or /proc/self/environ) and then retrieve the file contents in plaintext via an unauthenticated GET request to /get_image.[0]
The same configuration-write primitive lets attackers overwrite admin credentials via the UI_USERNAME and UI_PASSWORD parameters to gain full dashboard access, and register malicious pass-through proxy routes that exfiltrate resolved API secrets to attacker-controlled servers.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| BerriAI LiteLLM | All versions prior to 1.83.0; especially deployments with default, weak, or missing master key settings | Fixed in version 1.83.0[0][1] |
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| cve | CVE-2026-35029 | The tracking identifier for the LiteLLM broken access control vulnerability exploited in the wild.[0][5] |
Key takeaways
- AI gateways like LiteLLM concentrate high-value secrets — provider API keys, user/spend databases, and admin credentials — making a control-plane compromise catastrophic.[0]
- CVE-2026-35029 is under active in-the-wild exploitation via automated scanning, so patching to 1.83.0 and hardening master keys are urgent.[0]
Defensive actions
- Upgrade LiteLLM proxy installations to version 1.83.0 or later immediately.: Version 1.83.0 resolves CVE-2026-35029; all prior versions remain vulnerable to full server takeover.[0][1]
- Configure unique master keys for all production gateways and never deploy with default credentials like sk-1234.: Deployments with default, weak, or missing master key settings are directly exploitable.[0]
- Restrict administrative routes from public internet access, placing the gateway control plane behind a trusted VPN or private subnet.: Attackers launched automated scans against exposed admin endpoints; isolating the control plane prevents unauthorized exploitation attempts.[0]