LiteLLM gateway v1.77.7 contains critical RBAC bypass and SSRF vulnerabilities enabling arbitrary file read, admin takeover, and RCE; fixed in v1.83.9. Missing authorization on /config/update lets any authenticated user inject environment variables, enabling file read via UILOGOPATH, admin credential overwrite, and RCE through S3-hosted Python modules. A separate SSRF via user_config exfiltrates LLM provider API keys.
RBAC Bypass
2 posts
When LLM Gateways Go Wrong: Findings from LiteLLM - Check Point Research CISA Malcolm (CVE-2026-55676, CVE-2026-63133, CVE-2026-63134 +3 more) CISA disclosed six vulnerabilities in the CISA Malcolm network traffic analysis tool suite. The most severe is CVE-2026-55676 (CVSS 8.8), which allows authenticated users with the upload-only role to upload and execute arbitrary PHP code. Two RBAC bypass vulnerabilities (CVE-2026-63177 and CVE-2026-19670) exploit discrepancies between Nginx routing and the Lua RBAC layer's URI normalization. Two denial-of-service vulnerabilities (CVE-2026-63133 and CVE-2026-19671) exploit resource exhaustion during archive extraction. Patches are available across versions 26.06.1, 26.07.0, and 26.08.0.