Check Point Discloses Two High-Impact Vulnerabilities in LiteLLM AI Gateway Allowing Low-Privilege Users to Steal API Keys
Check Point has disclosed two vulnerabilities in LiteLLM, an open-source AI gateway downloaded more than 90 million times per month. The issues, tracked as CVE-2026-35029 (CVSS 8.7) and CVE-2026-59823 (CVSS 5.3), affect all versions before 1.83.9 and allow low-privilege users to take over the gateway, read server files, and steal API keys stored for providers such as OpenAI, Anthropic, and Azure OpenAI.
A recent incident at an internet company illustrated the risk when an intern successfully called the GPT-4 API using a corporate key. Investigation revealed that the LiteLLM instance lacked proper authorization checks on its configuration endpoint, enabling any authenticated account to alter settings arbitrarily.
What LiteLLM Does
LiteLLM acts as a central proxy that unifies access to more than 140 AI vendors. It handles routing, load balancing, key management, usage monitoring, and cost control so developers do not need to manage individual provider APIs directly. Because it stores real API credentials for enterprise use, compromise of the gateway can lead to unauthorized consumption of AI resources and exposure of business logic derived from call patterns.
CVE-2026-35029: Unauthorized Configuration Changes
The first flaw resides in the /config/update endpoint. The code performs no role verification, so any authenticated user—including interns or accounts obtained through phishing—can modify runtime settings. Attackers can read arbitrary server files containing stored keys, redirect requests to attacker-controlled servers, hijack administrator accounts, or implant malicious code for remote code execution.
CVE-2026-59823: SSRF Vector
The second issue is a server-side request forgery vulnerability. When combined with the configuration flaw, it allows an attacker to force the gateway to reach internal databases, metadata services, or other sensitive systems. In cloud environments this often serves as the initial step toward obtaining temporary credentials and lateral movement.
Scope and Remediation
LiteLLM 1.83.9 contains fixes for both vulnerabilities. Because the component is frequently embedded inside larger AI platforms rather than deployed standalone, many organizations may be unaware of its presence. Security teams should:
- Upgrade via pip install litellm --upgrade
- Restrict access to the management interface so only users with the proxy_admin role can call configuration endpoints
- Rotate all stored API keys if unauthorized access cannot be ruled out
- Search codebases and dependency files for references to litellm
- Enable detailed logging to detect anomalous configuration changes
The disclosure underscores that core security controls remain essential even in rapidly adopted AI infrastructure.
Related articles
Roundcube Webmail Issues Security Updates to Address Multiple Vulnerabilities
The Roundcube Webmail development team released versions 1.7.5 and 1.6.20 on October 19, 2026, to resolve approximately 20 security issues affecting email viewing, authentication, and external content handling. The updates address command injection flaws in IMAP actions that could be triggered via newline characters, as well as header injection vulnerabilities involving sender display names and parameters such as References, In-Reply-To, Message-ID, and From. Additional fixes cover subject lines and data URIs in forwarded attachments, media types in inline images, and bypasses in server-side request forgery filters. The patches also mitigate cross-site request forgery evasion in spam reporting and cross-site scripting issues stemming from password driver error responses. Administrators are urged to apply the updates promptly to prevent exploitation of these weaknesses.
Cybercriminals Exploit Command Injection Vulnerability in SiteGuard WAF Server Edition
EG Secure Solutions has confirmed active exploitation of CVE-2026-106931, a command injection flaw in the statistics processing function of SiteGuard Server Edition. The vulnerability, classified as CWE-78, allows local attackers with low privileges to execute arbitrary system commands as root on Unix systems or SYSTEM on Windows without user interaction. CVSS scores rate the issue at 8.5 under version 4.0 and 7.8 under version 3.0, affecting installations from version 2.20 onward when statistics are enabled by default. Specific version ranges for Apache, Nginx, and IIS editions on FreeBSD and other platforms determine the exact impact, with some IIS versions remaining unaffected. The vendor notified direct support customers on September 29, followed by public advisories from JVN on October 14 and JPCERT/CC. Organizations unable to update can apply a targeted patch or disable the statistics feature, though the patch erases attack traces, requiring prior diagnostic data collection.
Gezine Demonstrates Debug Settings Access on PlayStation 5 Firmware 14.10
Security researcher Gezine has published a video showing access to the hidden Debug Settings menu on a retail PlayStation 5 running firmware version 14.10. Sony shipped the 14.00 update on October 1, which closed the previous kernel vulnerability used on 13.xx firmware, yet a new method was demonstrated only 18 days later. The technique is unrelated to the earlier Relapse exploit chain that worked up to version 13.60. Full system control is not achieved, and the previous method for extracting game executables no longer functions on 14.xx builds, likely requiring a separate hypervisor bypass. Gezine has stated that the new exploit details will not be released immediately and that any future disclosure decision will be made later.
Multiple Vulnerabilities Found in nginx Web Server, Three Rated Critical by F5
F5 disclosed an out-of-band security advisory on October 14, 2026, revealing a total of 11 vulnerabilities across nginx and related products. Five issues affect the core open-source nginx server while six more impact associated offerings including NGINX Gateway Fabric and NGINX Ingress Controller. The flaws can lead to denial of service, remote code execution, authentication bypass, and sensitive information disclosure. Although the official nginx project rates all five core vulnerabilities as Medium severity, F5 assigns a CVSS v4.0 base score of 9.2 to three of them, classifying them as Critical. One example is CVE-2026-15176, a heap buffer overflow in the ngx_http_core_module that triggers under specific URL rewrite and file-path configuration settings.