Authorization Bypass Vulnerability in LiteLLM Proxy Server by BerriAI

CVE-2026-35029

What is CVE-2026-35029?

CVE-2026-35029 is a significant authorization bypass vulnerability found in LiteLLM, a proxy server developed by BerriAI, designed to facilitate access to large language model (LLM) APIs in both OpenAI and native formats. This vulnerability exists in versions prior to 1.83.0 and specifically affects the /config/update endpoint, which does not properly enforce admin role authorization. As a result, any user who has authenticated to the LiteLLM platform can exploit this weakness to modify critical proxy configurations and environment variables. This can lead to severe consequences, such as the ability to execute arbitrary Python code by registering malicious endpoint handlers, retrieve sensitive server files, and even take control of user accounts by overwriting authentication variables. The absence of proper authorization checks presents a formidable risk to organizations utilizing LiteLLM, potentially resulting in unauthorized access and control over sensitive data and functionalities.

Potential impact of CVE-2026-35029

1. Remote Code Execution: Attackers could leverage this vulnerability to run arbitrary Python code on the server by manipulating configuration through the vulnerable endpoint, posing a severe risk of system compromise.

2. Data Exposure: By exploiting the vulnerability, unauthorized users can access sensitive files stored on the server, potentially leading to data breaches and loss of confidentiality for the organization.

3. Account Takeover: The ability to overwrite environment variables like UI_USERNAME and UI_PASSWORD can enable attackers to assume the identities of other users, facilitating privileged access and further abusive actions within the system.

References