Hackers could steal OpenAI, Anthropic keys through LiteLLM bugs
Many organizations won’t even know they’re exposed.
LiteLLM critical flaws found. Image by Cybernews / Unsplash.
Follow us
- Check Point found two critical LiteLLM flaws that affect gateways connecting apps with AI providers.
- One flaw lets low-access users reach admin functions, read files, change credentials, and run code.
- Another flaw can redirect gateway requests to attacker servers and expose AI provider API keys.
- LiteLLM fixed the issues in version 1.83.9; teams should check for indirect installations.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Researchers have found 2 critical vulnerabilities in LiteLLM, the open-source gateway many companies use to connect their apps to OpenAI, Anthropic, and Google. It has 97 million downloads a month and 59,000 GitHub stars.
The high-risk vulnerabilities, dangerous to any startups and platforms using LiteLLM, are tracked as CVE-2026-35029 and CVE-2026-59823, Check Point Research says.
The first bug lets someone with the lowest level of access – say, a read-only user – reach admin functions.
From there, they can read server files, overwrite admin credentials, and run their own code with read only access to reach administrative functions and take over the gateway.
Meanwhile, the second vulnerability allows attackers to redirect gateway requests to their own server and capture AI provider API keys.
Has your password leaked?
Many organizations won’t even know they’re exposed, the researchers point out in the blog post. Since LiteLLM is built into many other AI platforms, it can be running in places nobody deliberately installed it.
Essentially, LiteLLM, an open-source project, functions as an LLM gateway, the layer through which every request from an organization’s applications travels on its way to an AI provider.
In practical terms, anyone holding an account on a vulnerable LiteLLM deployment could take over the gateway and use it for malicious purposes,Check Point Research explains.
According to Mateo Rojas-Carulla, Head of Research, AI Agent Security at Check Point, the industry’s focus has largely been on securing AI models, but this research shows that securing AI infrastructure is equally important.
“As organizations increasingly rely on gateways such as LiteLLM to connect applications, users and AI services, these platforms become attractive targets because they sit at the centre of trust,” said Rojas-Carulla.
“The future of AI security will depend on securing every layer of the AI stack, because attackers will naturally target the one that gives them the greatest access with the least resistance.”
Boris Cipot, principal security engineer at Black Duck, added that the discovery essentially means that attackers don't need to breach OpenAI, Anthropic or Google directly.
"It may be easier to target the trusted software sitting between those providers and their customers. The risk is made harder to manage because LiteLLM can be embedded in other AI platforms and internal tools," said Cipot.
Check Point's cyber pros say they have disclosed both issues to LiteLLM, and the critical flaws are now resolved in LiteLLM version 1.83.9 and above.
Still, security teams are also advised to check for LiteLLM running indirectly, since, as mentioned above, it may be present in environments where it was never deployed as a standalone product.
