Critical LiteLLM Flaws Let Attackers Hijack AI Gateways and Steal API Keys

Two Critical Vulnerabilities Found in LiteLLM

Check Point Research has discovered two critical vulnerabilities in LiteLLM, the open-source gateway that many organizations use to connect their applications to AI providers such as OpenAI, Anthropic, and Google. The flaws, tracked as CVE-2026-35029 and CVE-2026-59823, are considered high-risk for any startups and platforms using LiteLLM, which records 97 million downloads per month and has 59,000 GitHub stars.

Low-Access Users Can Reach Admin Functions

According to the researchers, the first vulnerability allows someone with the lowest level of access, such as a read-only user, to reach administrative functions. From there, an attacker can read server files, overwrite admin credentials, and run their own code, effectively taking over the gateway. The second vulnerability allows attackers to redirect gateway requests to their own server and capture AI provider API keys.

Many Organizations May Not Know They Are Exposed

Check Point notes that many organizations may not even know they are exposed, since LiteLLM is built into many other AI platforms and can be running in environments where it was never deliberately installed as a standalone product. In practical terms, anyone holding an account on a vulnerable LiteLLM deployment could take over the gateway and use it for malicious purposes. The issues have been disclosed to LiteLLM and are resolved in version 1.83.9 and above, but security teams are advised to check for LiteLLM running indirectly in their environments.

Security Experts Urge Focus on AI Infrastructure

Mateo Rojas-Carulla, Head of Research for AI Agent Security at Check Point, said the industry's focus has largely been on securing AI models, but this research shows that securing AI infrastructure is equally important. He added that gateways such as LiteLLM sit at the centre of trust, making them attractive targets, and that the future of AI security will depend on securing every layer of the AI stack. Boris Cipot, principal security engineer at Black Duck, added that attackers no longer need to breach OpenAI, Anthropic, or Google directly, as it may be easier to target the trusted software sitting between those providers and their customers.

Sources: Cybernews