Attackers are actively exploiting a crucial authorization flaw in LiteLLM’s administrative API. This vulnerability permits low-privileged, read-only customers to switch proxy configurations, expose delicate secrets and techniques, and doubtlessly acquire full administrator management over affected servers.
Researchers at Zenity Labs tracked roughly 3,900 requests concentrating on LiteLLM’s administration endpoints from February to June 2026, originating from 73 totally different IP addresses.
Almost 1,000 of those requests particularly focused the delicate `/config/replace` endpoint, with exploit patterns linked to CVE-2026-35029.
LiteLLM Admin API Flaw
The vulnerability, disclosed on April 6, 2026, arises from a lacking authorization verify on the configuration replace route. LiteLLM variations earlier than 1.83.0 didn’t correctly confirm whether or not callers had administrator privileges earlier than permitting modifications to high-impact proxy settings. This concern was patched in LiteLLM model 1.83.0.
LiteLLM features as an AI gateway that centralizes entry to model-provider API keys, consumer and spending knowledge, proxy configurations, and administrative credentials. Its management airplane permits operators to create keys, configure fashions, set budgets, handle customers, and replace dwell settings.
This focus of privileges makes the executive API a lovely goal. Within the weak configuration, a read-only account might invoke `/config/replace` to switch settings that needs to be accessible solely to directors.
Researchers famous that attackers might exploit this flaw by altering the `UI_LOGO_PATH` setting, which controls the native file displayed because the dashboard brand.
If pointed to delicate recordsdata similar to `.env` recordsdata, configuration YAML recordsdata, or `/proc/self/environ`, the server could possibly learn these recordsdata. The unauthenticated `/get_image` route might then expose their contents to a distant requester.
Probably uncovered knowledge may embody LiteLLM grasp keys, AI supplier credentials, cloud entry tokens, database connection strings, and observability platform secrets and techniques.
The identical configuration write entry can even result in extra critical takeover situations. LiteLLM resolves chosen `os.environ/VARIABLE` references on the server, creating alternatives to extract environment-held secrets and techniques by way of operator-defined proxy routes.
An attacker who can modify dashboard login atmosphere variables might doubtlessly change the UI username and password, permitting them to authenticate as an administrator.
This is able to grant them broad entry to generate API keys, create customers, assessment spending and deployment knowledge, alter fashions, or delete sources.
Zenity efficiently reproduced this concern on LiteLLM model 1.74.0, demonstrating a whole assault chain utilizing a read-only account, a mounted delicate atmosphere file, and an attacker-controlled assortment service.
The primary probes concentrating on `/config/replace` had been detected by researchers on April 7, simply in the future after the CVE was revealed. Later file-read payloads had been noticed between Might 5 and Might 12, concentrating on frequent secret areas together with `/app/.env`, `/dwelling/litellm/.env`, configuration recordsdata, and course of atmosphere knowledge.
Further noticed exercise included default grasp key guessing, makes an attempt to create administrator customers by way of `/consumer/new`, key-generation requests, API enumeration, mannequin deletion makes an attempt, and SCIM endpoint probing. Researchers additionally found JavaScript-style prototype air pollution payloads, though these had been ineffective towards LiteLLM’s Python-based proxy.
Organizations operating LiteLLM ought to improve to model 1.83.0 or later instantly. Directors are suggested to rotate all doubtlessly uncovered secrets and techniques, configure sturdy non-default grasp keys, prohibit management airplane entry, and monitor requests to `/config/replace`, `/get_image`, `/key/generate`, and `/consumer/new`.
This marketing campaign highlights a broader threat related to AI gateways: a seemingly restricted account can result in a full infrastructure compromise when authorization controls round configuration administration fail.
Preserve your SOC updated on energetic malware & phishing inside 24h of their emergence. Attempt ANYRUN to stop incidents with early detection.
