Check Point details separate LiteLLM authorization and SSRF flaws

Check Point Research's October 13 assessment of LiteLLM 1.77.7 describes two separate vulnerabilities in the AI gateway. The advisory records identify different preconditions, effects, and fixed releases.

CVE-2026-35029 is a missing authorization check on /config/update. An authenticated user, including a low-privilege account, could change proxy configuration and environment values. Check Point describes resulting paths to arbitrary file reads, administrative account takeover, and remote code execution through attacker-controlled Python pass-through handlers. LiteLLM's GitHub advisory says the issue affects versions before 1.83.0 and was fixed in 1.83.0, when the endpoint began requiring the proxy_admin role. (Check Point Research; GitHub advisory GHSA-53mr-6c8q-9789)

CVE-2026-59823 is a separate server-side request forgery in the Clientside LLM Credentials feature. It requires an authenticated caller with a valid virtual key. LiteLLM blocks top-level api_base and base_url values, but the user_config parameter follows another code path. A caller could put api_base inside that object and have the proxy route a request to a chosen internal or external host. Check Point says that route could expose upstream provider keys. The GitHub advisory lists LiteLLM versions through 1.83.8 as affected and 1.83.9 as patched. (GitHub advisory GHSA-hx8v-g79f-8w5f)

The fixes are not interchangeable

The /config/update authorization flaw was fixed in 1.83.0. The SSRF issue remained through 1.83.8 and was fixed in 1.83.9. Check Point's assessment describes both findings from version 1.77.7 and reports that they are resolved as of 1.83.9; the vendor advisories give the more precise patch boundary for each CVE. Teams should verify the installed LiteLLM package version and whether low-privilege accounts and virtual keys are exposed to the affected paths.

The two CVEs should not be collapsed into a single exploit condition: CVE-2026-35029 requires an authenticated account and abuses proxy configuration authorization, while CVE-2026-59823 requires a valid virtual key and abuses nested routing configuration. The report documents research findings and does not establish real-world exploitation.