Which versions of Python are affected by CVE-2026-35029?

BerriAI LiteLLM versions prior to v1.83.0 contain a remote code execution vulnerability in the /config/update endpoint that allows attackers to execute arbitrary code, modify system configurations,…. A patch is available.

Is there a public PoC exploit available for CVE-2026-35029?

Yes, a public proof-of-concept exploit is available for CVE-2026-35029. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-35029?

Within 24 hours: Inventory all BerriAI LiteLLM instances and document versions in use; immediately disable or restrict network access to the /config/update endpoint. Within 7 days: Upgrade to LiteLLM v1.83.0 or later once patch validation is confirmed in your environment; apply network segmentation to limit endpoint exposure. Within 30 days: Conduct audit of proxy configurations, file access logs, and privileged account activity for the period of vulnerability exposure; implement API authentication and authorization controls per vendor hardening guidance.

Python CVE-2026-35029

Q: What is the CVSS score of CVE-2026-35029?

CVE-2026-35029 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

HIGH

Incorrect Authorization (CWE-863)

2026-04-03 https://github.com/BerriAI/litellm

GHSA-53mr-6c8q-9789

Authentication Bypass RCE Python

8.7

CVSS 4.0 · Vendor: https://github.com/BerriAI/litellm

Severity by source

Vendor (https://github.com/BerriAI/litellm) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (https://github.com/BerriAI/litellm).

CVSS VectorVendor: https://github.com/BerriAI/litellm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 29, 2026 - 20:22 vuln.today

cvss_changed

Patch released

Apr 04, 2026 - 02:30 nvd

Patch available

Analysis Generated

Apr 03, 2026 - 22:15 vuln.today

CVE Published

Apr 03, 2026 - 21:59 nvd

HIGH 8.7

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

101 pypi packages depend on litellm (75 direct, 27 indirect)

Ecosystem-wide dependent count for version 1.83.0.

DescriptionCVE.org

Impact

The /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to do the following:

Modify proxy configuration and environment variables
Register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution
Read arbitrary server files by setting UI_LOGO_PATH and fetching via /get_image
Take over other priveleged accounts by overwriting UI_USERNAME and UI_PASSWORD environment variables

Patches

Fixed in v1.83.0. The endpoint now requires proxy_admin role.

Workarounds

Restrict API key distribution. There is no configuration-level workaround.

AnalysisAI

Remote code execution in BerriAI LiteLLM (pkg:pip/litellm) prior to v1.83.0 allows authenticated users without admin privileges to execute arbitrary Python code, modify proxy configuration, read server files, and hijack privileged accounts via an improperly protected /config/update endpoint. Authentication requirements not confirmed from available data. No public exploit identified at time of analysis, but the attack surface is well-documented in the vendor advisory. CVSS score unavailable; however, the combination of RCE capability and authentication bypass warrants immediate remediation for all LiteLLM deployments.

Technical ContextAI

LiteLLM is a Python-based proxy/gateway for LLM API management (distributed via PyPI as pkg:pip/litellm). The vulnerability stems from CWE-863 (Incorrect Authorization), where the /config/update API endpoint fails to enforce role-based access control. While the platform implements a proxy_admin role for administrative operations, this endpoint was accessible to any authenticated user regardless of role. The endpoint's design allows modification of critical runtime configuration including environment variables, custom endpoint handlers (which can execute arbitrary Python callables), and UI settings. This architectural flaw transforms a configuration management feature into a privilege escalation vector, as authenticated low-privilege users can invoke admin-level operations without authorization checks. The vulnerability affects core platform security boundaries by allowing lateral movement from any valid credential to full system compromise.

RemediationAI

Vendor-released patch: Upgrade to LiteLLM version 1.83.0 or later via pip (pip install --upgrade litellm>=1.83.0). The fixed version implements proper proxy_admin role enforcement on the /config/update endpoint. No configuration-based workaround exists for versions prior to 1.83.0. As an interim risk reduction measure pending upgrade, the vendor recommends restricting API key distribution to minimize the number of authenticated users who could exploit the vulnerability, though this does not eliminate the attack surface. Organizations should audit API key assignments and revoke unnecessary credentials immediately. Full advisory and patch details available at https://github.com/BerriAI/litellm/security/advisories/GHSA-53mr-6c8q-9789. After upgrading, validate that only users with explicit proxy_admin role can access /config/update by testing with non-admin credentials.