Threat
Check Point Research Discovers High Risk Vulnerabilities in LiteLLM, One of the Most Widely Used LLM Gateways
First reported · Discovered checkpoint.com
Page published
Earliest dated coverage: 13 Oct 2026 · First observed: 24 Oct 2026 · Latest dated coverage: 13 Oct 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
LiteLLM gateways centralize AI provider credentials and application traffic, making these vulnerabilities a route from a basic user account to compromise of sensitive AI infrastructure.
Check Point Research disclosed two LiteLLM vulnerabilities: CVE-2026-35029 lets low-privileged users perform administrative actions and take over the gateway, while CVE-2026-59823 enables SSRF that exposes AI provider API keys. Researchers demonstrated system takeover, file access, credential theft, and remote code execution in a controlled environment. Both vulnerabilities are fixed in LiteLLM version 1.83.9 and above.