LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint

The /config/update endpoint in LiteLLM lacks proper admin role authorization, creating a significant security risk. An attacker who has already authenticated to the platform can exploit this to modify proxy configurations and environment variables, effectively controlling the application's behavior. More critically, they can register custom pass-through endpoint handlers, allowing them to execute arbitrary Python code on the server – leading to Remote Code Execution (RCE). Furthermore, attackers can read arbitrary server files by manipulating the UILOGOPATH variable and accessing /getimage. Finally, they can potentially take over privileged accounts by overwriting the UIUSERNAME and UI_PASSWORD environment variables, gaining unauthorized access to sensitive data and system resources.

Organizations deploying LiteLLM in production environments, particularly those with multiple users or roles, are at risk. Shared hosting environments where users have limited control over server configurations are also particularly vulnerable. Legacy deployments using older versions of LiteLLM are at the highest risk.

• python / server:

import os
import subprocess

def check_env_vars():
    sensitive_vars = ['UI_USERNAME', 'UI_PASSWORD']
    for var in sensitive_vars:
        if var in os.environ:
            print(f"Warning: Sensitive environment variable '{var}' is set.")

check_env_vars()

• python / server: Check for unauthorized modifications to proxy configurations or custom endpoint handlers in LiteLLM's configuration files. • python / server: Monitor system logs for unusual activity related to the /config/update endpoint, such as unexpected requests or modifications to environment variables. • python / server: Review LiteLLM's environment variables for unexpected or unauthorized values using os.environ.

1. 2026-04-06Disclosure

   disclosure

1. Gereserveerd2026-03-31
2. Gepubliceerd2026-04-06
3. Gewijzigd2026-04-29
4. EPSS bijgewerkt2026-04-14

The primary mitigation for CVE-2026-35029 is to immediately upgrade LiteLLM to version 1.83.0 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. Restrict access to the /config/update endpoint to only authorized administrators. Implement strict input validation and sanitization on all parameters passed to this endpoint. Consider using a Web Application Firewall (WAF) to block suspicious requests targeting this endpoint. Regularly review and audit environment variables to detect any unauthorized modifications.