LiteLLM 1.83.9 Closed /config/update. Your Pin May Be 1.77

Check Point Research dated October 13 is the technical note. They assessed LiteLLM v1.77.7, the open-source Python gateway people put in front of model APIs. Two issues, CVE-2026-35029 and CVE-2026-59823, are marked resolved as of 1.83.9. The first is a missing authorization check on POST /config/update. The second is SSRF in a feature they call Clientside LLM Credentials.

The Check Point blog the same day is the version you can send to a manager. Low-privileged user to admin functions. Full takeover in their test. Provider API keys riding outbound requests to an attacker server. Infosecurity Magazine on October 15 repeats the versions: older than 1.83.9. Mateo Rojas-Carulla, Check Point’s head of research for AI agent security, says anyone holding an account on a vulnerable deployment could take over the gateway.

This is a Python pin, not a model card. We already had Unsloth Studio reading config.json while Transformers ran the file. uv 0.12.18 fixed a wheel path. 3.15.0 after RC3 is the interpreter. This week is the proxy in your requirements.txt.

/config/update was admin without the admin check

Check Point’s research post is specific about the route. LiteLLM’s proxy exposes POST /config/update so you can change runtime configuration: environment variables, model lists, general proxy settings. In other admin endpoints, they say, the code checks for PROXY_ADMIN before doing anything. They name /invitation/new as a route that does the check. /config/update did not. There was also an overly permissive route allowlist for UI sessions.

CVE-2026-35029 is that gap. A missing function-level authorization check plus a session allowlist that let UI users reach more than they should. The blog’s plain-language version: an access control flaw that let low-privileged users perform administrative actions, leading to full system takeover.

From there, Check Point describes a chain, not a single JSON edit. Arbitrary file read. Administrative account takeover. Remote code execution via malicious Python modules loaded from cloud storage. That last step is the one Python people should flinch at. A gateway that can pull and run modules is a gateway that is already a code-execution service. RBAC was the only adult in the room, and this route skipped it.

Rojas-Carulla’s Infosecurity quote is the operational one. You did not need to be unauthenticated. You needed an account. Read-only, in the blog’s telling, was enough to start. If your LiteLLM has “view” users because someone wanted a dashboard, those users were in the blast radius.

Do not take “we only expose it on the VPC” as the RBAC check. The bug is inside the process, after auth.

SSRF on client credentials is how the provider keys leave

CVE-2026-59823 is separate. Check Point: server-side request forgery in Clientside LLM Credentials. A user could make the gateway send API requests to a server they control. The redirected requests carried the keys LiteLLM uses with OpenAI, Anthropic, and whoever else you configured. The providers were not breached. Your proxy was helpful.

The blog lists the obvious bills. Stolen keys. Unauthorized use of the org’s provider accounts. Unexpected token spend. Infosecurity adds the rest of a takeover picture for the first CVE: file access, stolen login credentials, remote code execution.

If you rotate OpenAI keys every time a chatbot repo leaks, and you never rotate the key sitting in LiteLLM’s env, you were solving the wrong leak. The SSRF makes the gateway the exfil path. The attacker does not need your laptop.

Check Point says they demonstrated takeover, file access, credential theft, and RCE in a controlled environment. That is a lab sentence. Treat it as “the chain is not theoretical.” Do not treat it as “every 1.77 box is already mined.” You still patch.

Coordinated disclosure, per Infosecurity. LiteLLM 1.83.9 and later include the fixes. The research post’s assessed version is 1.77.7. Everything in between is the question you ask pip, not the question you ask the model.

Cybernews’s download count is their number. Your freeze file is yours

Cybernews, October 14, writes 97 million downloads a month and 59,000 GitHub stars. Those are Cybernews’s figures. I am not going to pretend I recounted PyPI. The useful part of that article is not the scoreboard. It is the embedding warning. LiteLLM can sit inside other AI platforms and internal tools. You may not have a service named LiteLLM on the wiki. You may still import it.

Gintaras Radauskas quotes a researcher, Cipot, on the idea that it may be easier to target the trusted software between providers and customers than to target the providers. That is this week’s whole genre. The model vendors have a SOC. Your proxy has a FastAPI-shaped attack surface and a pin from March.

Inventory is the unglamorous patch. Search internal images for litellm. Search lockfiles. Search Helm charts that pull a gateway you did not write. If the version string is below 1.83.9, you are on Infosecurity’s “older than” list.

Do not celebrate a star count. Stars are not a patch process. Check Point found missing RBAC on an admin POST. That is a basic control. Popularity did not supply it.

If LiteLLM is a transitive dependency, your app’s users may be the “authenticated account” in Rojas-Carulla’s sentence. That is worse than a dedicated proxy with three admins.

Patch is 1.83.9. Proof is the freeze, not the blog

The only version that closes both CVEs in these write-ups is 1.83.9 and above. If your platform team heard “LiteLLM is fine” because a chat demo still answers, they checked the model, not the proxy.

Practical order. Upgrade. Recycle provider keys that lived in that process. Recycle any admin credentials the config endpoint could have overwritten. Read whether /config/update is even exposed on the network you think it is. If you needed runtime config from the UI, put PROXY_ADMIN in front of it for real, then verify with a non-admin token.

Check Point’s contrast with /invitation/new is a code-review prompt. Grep for other routes that mutate env or load modules. One missing decorator is how this class of bug keeps shipping.

RCE via Python modules from cloud storage is the feature to question even after the RBAC fix. If the gateway can fetch and import, treat that as trust_remote_code with extra steps. We already had that fight in an Unsloth Studio piece. Different package, same instinct: config that points at code is code.

Logs. If you have them, look for /config/update from identities that should never hit it. If you do not have them, you will not get a tidy IOC blog. You will get a key rotation and a shrug.

This is a web service that happens to speak models

LiteLLM’s job, in Infosecurity’s explainer, is to sit between an application and one or more LLM providers so the app does not call the vendors directly. That is an HTTP proxy. It has sessions, routes, env, and a config POST. The fact that the upstream is GPT-something does not change how you patch a missing RBAC check.

Python teams keep learning this. Yesterday the hole is a wheel path. Today it is a gateway. Tomorrow it is another “AI layer” that is a Flask app with a marketing site. The best-practice is boring: pin, expose least, check admin routes, do not load modules from buckets because a YAML key said so.

If you rolled LiteLLM to unify OpenAI and Anthropic keys, you also unified the theft. SSRF on the credentials feature is that unification wearing a CVE.

Do not confuse “open source” with “someone else is on call.” Check Point disclosed. The project patched. Your cluster is still your cluster.

A read-only dashboard user is a user. The blog says that was enough for 35029. If you gave every developer a login so they could see spend, you gave every developer a path to env.

Runtime config is the feature people buy a gateway for. Swap models without a deploy. Add a fallback. Change a timeout. /config/update exists because that product pitch exists. Check Point’s finding is that the pitch shipped without the same PROXY_ADMIN guard they already wrote for invitations. If you built a similar proxy in-house, grep your own config POST before you finish laughing at 1.77.7.

The cloud-storage module load is the part that turns a bad RBAC check into RCE. A config change that only edits a JSON list of model names is ugly. A config change that tells the process to import Python from a bucket is a remote shell with extra YAML. Even after 1.83.9, ask whether that load path is on in your deployment. If you do not need it, disable it. If you need it, treat the bucket as production code and lock who can write objects.

Keys in env are still keys. SSRF 59823 does not need RCE if the gateway will kindly POST the Authorization header to an attacker URL. Rotate the provider credentials that sat in that process even if you see no /config/update in logs. Absence of logs is not absence of a redirect.

Container tags named gateway or llm-proxy are where 1.77 hides after someone upgrades the git submodule and forgets the image. Rebuild. Then check the running container, not the Dockerfile on main.

What to write in the ticket

Title the change with the version, not the nickname. LiteLLM 1.83.9. CVE-2026-35029, CVE-2026-59823. Source: Check Point Research, October 13; Infosecurity, October 15.

Acceptance: freeze file shows 1.83.9 or newer; /config/update rejected for a non-admin token; provider keys rotated; images rebuilt so 1.77.7 is not hiding in a tag called latest.

Out of scope: retraining anything. The model did not do this. The proxy did.

If you cannot upgrade today, take the UI off the internet and take non-admin accounts off the proxy. That is mitigation, not a fix. Infosecurity’s affected line is still “older than 1.83.9.”

Check Point assessed 1.77.7. If your pin says litellm>=1.70 you can still land on a vulnerable wheel tonight. Pin the floor at 1.83.9. If a transitive tool vendors an older tree, vendor the patch or drop the tool.

Cybernews can keep the download chart. You keep the pin. The gateway is Python. The bug is an admin POST. The patch is a version number. Ship it.