Attackers are actively probing LiteLLM AI gateway deployments for a known authorization flaw that can turn a low-privilege account into full administrative control.
The issue, tracked as CVE-2026-35029, affects LiteLLM versions before 1.83.0 and allows authenticated users to access the sensitive /config/update endpoint without the required administrator role.
LiteLLM acts as an AI gateway between enterprise applications and model providers. It can store provider API keys, database connection details, user data, spending records, and administrative credentials.
This makes exposed LiteLLM control planes a valuable target for attackers seeking cloud credentials, AI service keys, or a path into connected infrastructure. The vulnerability stems from the absence of an authorization check on the /config/update API route.
Hackers Exploit LiteLLM Admin API Flaw
In affected releases, an authenticated account with a limited role, such as the read-only proxy_admin_viewer role, could modify settings reserved for full administrators. LiteLLM corrected the issue in version 1.83.0 by requiring the proxy_admin role for configuration changes.
Researchers observed attackers abusing the flaw to modify environment variables and configuration values. One technique changes UI_LOGO_PATH, a setting that identifies the dashboard logo file.
By replacing the normal image path with a sensitive server-side file, such as /app/.env or /proc/self/environ, an attacker can cause LiteLLM to read it.
The content can then be retrieved through the /get_image endpoint, which reportedly does not require authentication in vulnerable deployments.
This technique can expose secrets stored in environment files and configuration files. Potentially exposed data includes model-provider API keys, the LiteLLM master key, database URLs, AWS credentials, and observability platform tokens.
The flaw can also be used to overwrite UI_USERNAME and UI_PASSWORD environment variables, enabling an attacker to replace dashboard credentials and take over the administration interface.
The security impact can extend beyond data theft. Advisories state that attackers can register malicious pass-through endpoint handlers through altered configuration.
Such handlers may point to attacker-controlled code or infrastructure, creating a route to remote code execution or secret exfiltration.
Zenity honeypot telemetry recorded roughly 3,900 requests against LiteLLM administrative API endpoints between February and June 2026, including about 1,000 requests targeting /config/update.
The first configuration-update probes appeared on April 7, one day after CVE-2026-35029 was publicly disclosed. Researchers later saw direct file-read payloads attempting to load common secret locations, including /app/.env, /home/litellm/.env, /app/config.yaml, and /app/proxy_server_config.yaml.
The activity also included attempts to guess master keys such as sk-1234 and sk-litellm-master-key, generate new API keys, create administrator accounts, enumerate users and keys, probe SCIM provisioning routes, and delete models.
These actions show that threat actors are not merely scanning for the CVE they are mapping and attempting to control exposed AI gateway environments.
Organizations using LiteLLM should immediately upgrade to version 1.83.0 or later. This release adds the missing authorization enforcement for /config/update.nvd.nist+1
Administrators should also remove LiteLLM control-plane services from public internet exposure, place the Admin UI and administrative endpoints behind an authenticated reverse proxy or internal network, and ensure a strong, unique master key is configured. Default or documentation-example values must never be used.
Security teams should review logs for suspicious requests to /config/update, /get_image, /key/generate, /user/new, /model/delete, and /scim/. Requests that set UI_LOGO_PATH to local file paths should be treated as likely attempts at exploitation.
Finally, organizations that operated an exposed LiteLLM version before 1.83.0 should rotate all potentially exposed secrets. This includes LiteLLM master keys, LLM provider API keys, database passwords, cloud credentials, and third-party monitoring tokens, as the vulnerability can expose these values via configuration manipulation and arbitrary file reads.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
The post Hackers Exploit LiteLLM Admin API Flaw to Steal Secrets and Target AI Gateway Servers appeared first on Cyber Security News.