GCVE-1988-2026-0260
Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-11 07:38
VLAI
EPSS
VEX
Title
SEC Consult SA-20260421-0 :: Broken Access Control in Config Endpoint in LiteLLM
Summary
SEC Consult Vulnerability Lab Security Advisory < 20260421-0 >
=======================================================================
title: Broken Access Control in Config Endpoint
product: LiteLLM
vulnerable version: <=v1.83.0
fixed version: v1.83.0-nightly
CVE number: CVE-2026-35029
impact: high
homepage:https://www.litellm.ai/
found: 2026-02-24
by: Timo Müller (Office Munich)
SEC Consult Vulnerability Lab
An integrated part of SEC Consult, an Atos business
Europe | Asia
https://www.sec-consult.com
=======================================================================
Vendor description:
-------------------
"AI Gateway to provide model access, fallbacks and spend tracking across 100+
LLMs. All in the OpenAI format."
Source:https://www.litellm.ai/
Business recommendation:
------------------------
The vendor provides a patch which should be installed immediately.
SEC Consult highly recommends to perform a thorough security review of the product
conducted by security professionals to identify and resolve potential further
security issues.
Vulnerability overview/description:
-----------------------------------
1) Broken Access Control in Config Endpoint (CVE-2026-35029)
LiteLLM exposes a /config/update API endpoint that allows administrators to
make configuration changes to the instance. Due to a missing authorization
check, low-privileged users can access this endpoint without restriction.
An attacker with a low-privileged account can exploit this to exfiltrate
environment variables and read arbitrary files within the context of the
LiteLLM application.
Proof of concept:
-----------------
1) Broken Access Control in Config Endpoint (CVE-2026-35029)
The vulnerability exists because the update_config function, which handles the
/config/update route, does not check whether the requesting user has
administrative permissions.
The vulnerable function can be seen
here:https://github.com/BerriAI/litellm/blob/47c24ef8ae1b6c77827491437b3e3ed143c1e77f/litellm/proxy/proxy_server.py#L11337-L11481
The following screenshot illustrates a request sent by a regular user without
administrative privileges. The exploit leverages "Pass Through Endpoints",
which allow administrators to route requests from the LiteLLM proxy to
any external API.
Pass Through Endpoints:https://docs.litellm.ai/docs/proxy/pass_through
The request contains the following parameters:
* path - defines the path under which the pass through endpoint is created
* target - the attacker-controlled server to which requests are routed
(i.e. the exfiltration server receiving sensitive data)
* headers - a list of headers containing the exfiltrated data, populated by
LiteLLM before routing the request to the attacker-controlled server
The "X-DB-URL" header retrieves the DATABASE_URL environment variable from the
LiteLLM environment. The LANGFUSE* headers are used to exfiltrate files from
the LiteLLM host system. Specifically, these headers are chosen because LiteLLM
base64-encodes any values passed to them.
LANGFUSE* header
encoding:https://github.com/BerriAI/litellm/blob/47c24ef8ae1b6c77827491437b3e3ed143c1e77f/litellm/proxy/pass_through_endpoints/pass_through_endpoints.py#L100-L115
<10_exploit.png>
Once the configuration is set, the pass through route update can take several
minutes. After this wait time, the attacker triggers exfiltration by calling the
endpoint. The exfiltration request is shown in the following screenshot.
Please note that the LiteLLM response contains the response data from the
exfiltration server.
<20_exfil.png>
The following screenshot illustrates the successful exploitation of this issue,
showing the request received by the attacker-controlled server from the
LiteLLM instance. The DATABASE_URL environment variable is visible highlighted
within the server header, and the contents of /etc/passwd are included in
base64-encoded form within the Authorization header.
<30_content.png>
Decoding the base64-encoded Authorization header reveals the contents of
the /etc/passwd file from the LiteLLM host system:
<40_decoded.png>
Vulnerable / tested versions:
-----------------------------
The following version has been tested which was the latest version available
at the time of the test:
* 1.81.12
Vendor contact timeline:
------------------------
2026-02-26: Contacting vendor throughsupport () berri ai.
2026-03-10: Inquiry sent to verify whether the vendor has
received and analysed the advisory.
2026-03-10: BerriAI confirms receipt of the advisory and
loops in engineers for vulnerability analysis.
2026-04-01: A security patch for the reported vulnerability
is released on the nightly build.
2026-04-01: Vendor contacted for additional details
to coordinate advisory disclosure.
2026-04-03: A CVE is assigned to the vulnerability and it is disclosed
without further coordination through the GitHub
security page of LiteLLM.
2026-04-07: A draft version of the advisory is sent to the vendor
in preparation of the advisory release.
2026-04-14: The vendor is informed that the advisory will be released
the upcoming week.
2026-04-14: The vendor validates the submitted draft advisory
and confirms the planned release.
2026-04-21: Coordinated release of advisory.
Solution:
---------
The vendor provides a patched version v1.83.0-nightly which can be
downloaded from their website:
https://github.com/BerriAI/litellm/releases
Fix commit:https://github.com/BerriAI/litellm/commit/57c05459ae9b4e607bfb35228ec13a3ee8586ce4
Workaround:
-----------
None
Advisory URL:
-------------
https://sec-consult.com/vulnerability-lab/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Vulnerability Lab
An integrated part of SEC Consult, an Atos business
Europe | Asia
About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an
Atos business. It ensures the continued knowledge gain of SEC Consult in the
field of network and application security to stay ahead of the attacker. The
SEC Consult Vulnerability Lab supports high-quality penetration testing and
the evaluation of new offensive and defensive technologies for our customers.
Hence our customers obtain the most current information about vulnerabilities
and valid recommendation about the risk profile of new technologies.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your applicationhttps://sec-consult.com/career/
Interested in improving your cyber security with the experts of SEC Consult?
Contact our local officeshttps://sec-consult.com/contact/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Mail: security-research at sec-consult dot com
Web:https://www.sec-consult.com
Blog:http://blog.sec-consult.com
X:https://x.com/sec_consult
EOF Timo Müller / @2026
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
16 references
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Litellm | SEC Consult SA-20260421-0 |
Affected:
unknown
|
guessed |
Relationships
reference
GCVE-1988-2026-0260 (this record)
- related CVE-2026-35029
{
"containers": {
"cna": {
"affected": [
{
"product": "SEC Consult SA-20260421-0",
"vendor": "Litellm",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "SEC Consult Vulnerability Lab via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260421-0 \u003e\n=======================================================================\n title: Broken Access Control in Config Endpoint\n product: LiteLLM\n vulnerable version: \u003c=v1.83.0\n\u00a0 \u00a0 \u00a0 fixed version: v1.83.0-nightly\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2026-35029\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n homepage:https://www.litellm.ai/\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2026-02-24\n by: Timo M\u00fcller (Office Munich)\n SEC Consult Vulnerability Lab\n\n An integrated part of SEC Consult, an Atos business\n Europe | Asia\n\n https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"AI Gateway to provide model access, fallbacks and spend tracking across 100+\nLLMs. All in the OpenAI format.\"\n\nSource:https://www.litellm.ai/\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides a patch which should be installed immediately.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Broken Access Control in Config Endpoint (CVE-2026-35029)\nLiteLLM exposes a /config/update API endpoint that allows administrators to\nmake configuration changes to the instance. Due to a missing authorization\ncheck, low-privileged users can access this endpoint without restriction.\nAn attacker with a low-privileged account can exploit this to exfiltrate\nenvironment variables and read arbitrary files within the context of the\nLiteLLM application.\n\n\nProof of concept:\n-----------------\n1) Broken Access Control in Config Endpoint (CVE-2026-35029)\nThe vulnerability exists because the update_config function, which handles the\n/config/update route, does not check whether the requesting user has\nadministrative permissions.\n\nThe vulnerable function can be seen \nhere:https://github.com/BerriAI/litellm/blob/47c24ef8ae1b6c77827491437b3e3ed143c1e77f/litellm/proxy/proxy_server.py#L11337-L11481\n\nThe following screenshot illustrates a request sent by a regular user without\nadministrative privileges. The exploit leverages \"Pass Through Endpoints\",\nwhich allow administrators to route requests from the LiteLLM proxy to\nany external API.\n\nPass Through Endpoints:https://docs.litellm.ai/docs/proxy/pass_through\n\nThe request contains the following parameters:\n\n* path - defines the path under which the pass through endpoint is created\n* target - the attacker-controlled server to which requests are routed\n (i.e. the exfiltration server receiving sensitive data)\n* headers - a list of headers containing the exfiltrated data, populated by\n LiteLLM before routing the request to the attacker-controlled server\n\nThe \"X-DB-URL\" header retrieves the DATABASE_URL environment variable from the\nLiteLLM environment. The LANGFUSE* headers are used to exfiltrate files from\nthe LiteLLM host system. Specifically, these headers are chosen because LiteLLM\nbase64-encodes any values passed to them.\n\nLANGFUSE* header \nencoding:https://github.com/BerriAI/litellm/blob/47c24ef8ae1b6c77827491437b3e3ed143c1e77f/litellm/proxy/pass_through_endpoints/pass_through_endpoints.py#L100-L115\n\n\u003c10_exploit.png\u003e\n\nOnce the configuration is set, the pass through route update can take several\nminutes. After this wait time, the attacker triggers exfiltration by calling the\nendpoint. The exfiltration request is shown in the following screenshot.\nPlease note that the LiteLLM response contains the response data from the\nexfiltration server.\n\n\u003c20_exfil.png\u003e\n\nThe following screenshot illustrates the successful exploitation of this issue,\nshowing the request received by the attacker-controlled server from the\nLiteLLM instance. The DATABASE_URL environment variable is visible highlighted\nwithin the server header, and the contents of /etc/passwd are included in\nbase64-encoded form within the Authorization header.\n\n\u003c30_content.png\u003e\n\nDecoding the base64-encoded Authorization header reveals the contents of\nthe /etc/passwd file from the LiteLLM host system:\n\n\u003c40_decoded.png\u003e\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* 1.81.12\n\n\nVendor contact timeline:\n------------------------\n2026-02-26: Contacting vendor throughsupport () berri ai.\n2026-03-10: Inquiry sent to verify whether the vendor has\n received and analysed the advisory.\n2026-03-10: BerriAI confirms receipt of the advisory and\n loops in engineers for vulnerability analysis.\n2026-04-01: A security patch for the reported vulnerability\n is released on the nightly build.\n2026-04-01: Vendor contacted for additional details\n to coordinate advisory disclosure.\n2026-04-03: A CVE is assigned to the vulnerability and it is disclosed\n without further coordination through the GitHub\n security page of LiteLLM.\n2026-04-07: A draft version of the advisory is sent to the vendor\n in preparation of the advisory release.\n2026-04-14: The vendor is informed that the advisory will be released\n the upcoming week.\n2026-04-14: The vendor validates the submitted draft advisory\n and confirms the planned release.\n2026-04-21: Coordinated release of advisory.\n\n\nSolution:\n---------\nThe vendor provides a patched version v1.83.0-nightly which can be\ndownloaded from their website:\nhttps://github.com/BerriAI/litellm/releases\n\nFix commit:https://github.com/BerriAI/litellm/commit/57c05459ae9b4e607bfb35228ec13a3ee8586ce4\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:http://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Timo M\u00fcller / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T07:38:43Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/17"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Apr/17"
},
{
"url": "http://blog.sec-consult.com"
},
{
"url": "https://docs.litellm.ai/docs/proxy/pass_through"
},
{
"url": "https://github.com/BerriAI/litellm/blob/47c24ef8ae1b6c77827491437b3e3ed143c1e77f/litellm/proxy/pass_through_endpoints/pass_through_endpoints.py#L100-L115"
},
{
"url": "https://github.com/BerriAI/litellm/blob/47c24ef8ae1b6c77827491437b3e3ed143c1e77f/litellm/proxy/proxy_server.py#L11337-L11481"
},
{
"url": "https://github.com/BerriAI/litellm/commit/57c05459ae9b4e607bfb35228ec13a3ee8586ce4"
},
{
"url": "https://github.com/BerriAI/litellm/releases"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://sec-consult.com/career/"
},
{
"url": "https://sec-consult.com/contact/"
},
{
"url": "https://sec-consult.com/vulnerability-lab/"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.litellm.ai/"
},
{
"url": "https://www.sec-consult.com"
},
{
"url": "https://x.com/sec_consult"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Apr/17"
],
"discovery": "EXTERNAL"
},
"title": "SEC Consult SA-20260421-0 :: Broken Access Control in Config Endpoint in LiteLLM",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-35029",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0260",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/17",
"automated": true,
"contentSha256": "10bfc79f159ddf4dbf5310a684b0792ad676dc96d03e36d0518d3e1686800479",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/17",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-04-21T11:15:23Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0260"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T08:13:42Z",
"dateUpdated": "2026-09-11T07:38:43Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0260"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…