---
id: CVE-2026-35029
aliases:
  - GHSA-53mr-6c8q-9789
  - PYSEC-2026-2597
title: 'LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint'
summary: 'LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint'
severity: high
vendor: litellm
product: litellm
ecosystem: pip
affected:
  - litellm < 1.83.0
patched:
  - litellm 1.83.0
published: '2026-04-03'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:43.006877910Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-53mr-6c8q-9789'
references:
  - url: 'https://github.com/BerriAI/litellm/security/advisories/GHSA-53mr-6c8q-9789'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-35029'
  - url: 'https://github.com/BerriAI/litellm'
  - url: 'http://seclists.org/fulldisclosure/2026/Apr/17'
tags:
  - osv
  - pip
  - exploit-available
epss: 0.03982
epssPercentile: 0.90134
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/learner202649/CVE-2026-35029-PoC'
  nuclei:
    - CVE-2026-35029
  checkedAt: '2026-09-27T10:33:45.384Z'
exploitAvailable: true
ingestedAt: '2026-07-13T18:57:52.948Z'
---

## Overview

### Impact

The `/config/update endpoint` does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to do the following:

  - Modify proxy configuration and environment variables
  - Register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution
  - Read arbitrary server files by setting UI_LOGO_PATH and fetching via /get_image
  - Take over other priveleged accounts by overwriting UI_USERNAME and UI_PASSWORD environment variables

### Patches

Fixed in v1.83.0. The endpoint now requires `proxy_admin` role.

### Workarounds

Restrict API key distribution. There is no configuration-level workaround.

## Affected packages

- `litellm < 1.83.0`

## Remediation

Upgrade to a patched release:

- `litellm 1.83.0`