PYSEC-2026-2597
LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint
Quick fix
PYSEC-2026-2597 — litellm: upgrade to the fixed version with the command below.
pip install --upgrade 'litellm>=1.83.0'Details
### Impact
The `/config/update endpoint` does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to do the following:
- Modify proxy configuration and environment variables - Register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution - Read arbitrary server files by setting UI_LOGO_PATH and fetching via /get_image - Take over other priveleged accounts by overwriting UI_USERNAME and UI_PASSWORD environment variables
### Patches
Fixed in v1.83.0. The endpoint now requires `proxy_admin` role.
### Workarounds
Restrict API key distribution. There is no configuration-level workaround.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://github.com/BerriAI/litellm/security/advisories/GHSA-53mr-6c8q-9789[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2026-35029[ADVISORY]
- https://github.com/BerriAI/litellm[PACKAGE]
- http://seclists.org/fulldisclosure/2026/Apr/17[WEB]
- https://pypi.org/project/litellm[PACKAGE]
- https://github.com/advisories/GHSA-53mr-6c8q-9789[ADVISORY]