CVE-2026-35029High▾ MidnightPoC availableLiteLLM: Privilege escalation via unrestricted proxy configuration endpoint
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 6.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
26%
1 GitHub repo · Nuclei ×1
Last analysed / modified upstream
26% → 30%
The /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to do the following:
Fixed in v1.83.0. The endpoint now requires proxy_admin role.
Restrict API key distribution. There is no configuration-level workaround.
litellm < 1.83.0Upgrade to a patched release:
litellm 1.83.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-42203HighLiteLLM: Server-Side Template Injection in /prompts/test endpoint
CVE-2026-40217High· 8.8LiteLLM has a sandbox escape in custom-code guardrail
CVE-2026-59822High· 8.2LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format
CVE-2024-4890Medium· 4.9SQL injection in litellm
CVE-2026-47102High· 8.8LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint
CVE-2026-47101High· 8.8LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit