When LLM gateways go wrong: LiteLLM security assessment findings
When LLM Gateways Go Wrong: Findings from LiteLLM
Check Point Research's security assessment of the open-source LLM gateway LiteLLM 1.77.7 found multiple high-severity vulnerabilities, which have been fixed in version 1.83.9 of the project. The core issue is that the /config/update endpoint lacks role-based authorization checks, allowing any logged-in user (including low-privilege Internal Users) to modify the proxy's runtime configuration, thereby reading arbitrary files by injecting the UI_LOGO_PATH environment variable, overwriting UI_USERNAME and UI_PASSWORD to take over the admin account, and loading remote Python modules via s3:// or gcs:// forms to achieve remote code execution. There is also a separate issue: the user_config parameter of /chat/completions is not validated, which can cause SSRF and forward the LLM provider's API key to an attacker's server.
The disclosed exploit chain shows that a missing authorization check in an LLM gateway can escalate to remote code execution and credential theft; teams deploying similar gateways can use this to review their configurations.