Security flaws found in top open source AI gateway — LiteLLM vulnerabilties could affect millions of users (www.techradar.com)

Security researchers from Check Point Research (CPR) have identified two critical vulnerabilities in LiteLLM, a widely-used open-source AI gateway that connects applications to various large language models (LLMs). The flaws allow low-privileged users to gain administrative control, potentially leading to unauthorized access, sensitive file theft, and the ability to execute malicious code remotely. The first vulnerability (CVE-2026-35029) has a high severity score of 8.7/10 and involves improper access control. The second issue (CVE-2026-59823) relates to a server-side request forgery bug that could enable attackers to harvest API keys, thereby compromising organizations' AI service accounts and incurring unwanted costs. Given LiteLLM's popularity, with over 90 million monthly downloads, these vulnerabilities pose a significant risk to many organizations leveraging AI technologies. To mitigate the threat, users are urged to upgrade to LiteLLM version 1.83.9 or higher, rotate any potentially exposed credentials, and review user permissions to ensure that access controls are correctly enforced. As AI infrastructure faces the same security challenges as traditional enterprise software, organizations must incorporate rigorous security assessments and testing for AI gateways in their overall cybersecurity strategies.