A broken authorization check in LiteLLM’s administrative API is being actively targeted, allowing attackers with even read-only access to alter gateway settings, expose secrets, and seize administrator control.
Zenity observed exploitation attempts against CVE-2026-35029, a broken-access-control vulnerability affecting LiteLLM’s /config/update endpoint.
The flaw, disclosed on April 6, 2026 and fixed in LiteLLM version 1.83.0, enables accounts assigned the supposedly limited proxy_admin_viewer role to modify settings reserved for full administrators.
Hackers Exploit LiteLLM Admin API Flaw
That poses a severe risk to LiteLLM deployments, which commonly sit between applications and AI providers and handle model-provider API keys, user data, spending records, databases, and administrator credentials.
Honeypot telemetry collected between February and June 2026 recorded roughly 3,900 requests targeting LiteLLM administrative APIs from 73 IP addresses.
About 1,000 requests targeted /config/update, the route used by the LiteLLM dashboard to modify live proxy configuration.
The first observed attempts arrived on April 7, one day after CVE-2026-35029 became public. More specific file-read payloads were observed from May 5 through May 12, indicating that attackers rapidly incorporated the vulnerability into their scanning and exploitation activities.
The central issue is that /config/update did not properly verify whether the authenticated account had administrative privileges. A low-privileged user could therefore rewrite configuration values, including environment variables and UI settings.
One of the most dangerous configuration options is UI_LOGO_PATH, which instructs LiteLLM to read a local file and display it as the dashboard logo.
Attackers can allegedly redirect that setting toward sensitive files such as .env files, proxy configuration YAML files, or /proc/self/environ.
The data can then be retrieved through LiteLLM’s /get_image endpoint, which researchers said did not require authentication.
This creates an arbitrary local-file-read chain capable of exposing provider API keys, LITELLM_MASTER_KEY, database connection strings, AWS credentials, and observability-platform secrets.
Zenity also described a credential-exfiltration technique involving LiteLLM pass-through endpoints. By configuring outbound headers to reference environment variables, an attacker could cause the proxy to resolve server-side secrets and transmit them to an external collector.
A separate path enables account takeover: attackers can overwrite UI_USERNAME and UI_PASSWORD, then sign in through the dashboard with administrator privileges.
Observed traffic included default master-key guessing, credential minting attempts through /key/generate and /user/new, user and API-key enumeration, SCIM endpoint probing, and destructive requests aimed at /model/delete.
Some requests contained JavaScript prototype-pollution payloads intended to force admin flags. Although those payloads are ineffective against LiteLLM’s Python-based proxy, their presence indicates that attackers are testing multiple privilege-escalation routes rather than conducting generic internet-wide scans.
The file-read activity specifically targeted likely secret locations, including /app/.env, /home/litellm/.env, /app/config.yaml, and LiteLLM proxy configuration files.
Mitigation
Organizations should upgrade to LiteLLM 1.83.0 or later, avoid default master keys such as sk-1234, and restrict read-only roles.
Administrators should also remove the control plane from public exposure and place /config/update, /get_image, and the Admin UI behind an internal network boundary or authenticated reverse proxy.
Any organization that exposed a vulnerable LiteLLM instance should rotate provider keys, database credentials, Langfuse secrets, and the LiteLLM master key. A credential intended only for configuration should never be sufficient to compromise the entire AI gateway.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
