NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐍 PyPI
Not in CISA KEV

LiteLLM: Privilege escalation via unrestricted proxy configuration endpointGHSA-53mr-6c8q-9789

GHSA-53mr-6c8q-9789 is a CWE-863 vulnerability in litellm. EPSS puts its 30-day exploitation probability at 38.6% (99th percentile). A fix is available for litellm — see the affected versions and patch details below.

Also known asCVE-2026-35029PYSEC-2026-2597
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Nov 10, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • A successful exploit gives an attacker total control of the affected component, not partial access.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for GHSA-53mr-6c8q-9789.

EPSS Exploitation Probability

via FIRST.org ↗
38.6%probability of exploitation in next 30 days
Moderate Risk0.00%
Lower risk than most CVEs99th percentile — riskier than 99% of all scored CVEsHighest risk
0.00%16.3%32.7%49.0%13.3%38.6%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

1 pkg affected
🐍litellm

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

Impact

The /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to do the following:

  • Modify proxy configuration and environment variables
  • Register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution
  • Read arbitrary server files by setting UI_LOGO_PATH and fetching via /get_image
  • Take over other priveleged accounts by overwriting UI_USERNAME and UI_PASSWORD environment variables

Patches

Fixed in v1.83.0. The endpoint now requires proxy_admin role.

Workarounds

Restrict API key distribution. There is no configuration-level workaround.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐍PyPIlitellmall versions1.83.0pip install --upgrade 'litellm==1.83.0'

Affected Products

1 product · 1 configurations
Application
litellmlitellm
< 1.83.0
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for litellm, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update litellm to 1.83.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-53mr-6c8q-9789 is resolved across your whole dependency graph.

  3. Workarounds

    Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.

How to detect GHSA-53mr-6c8q-9789

A community-maintained Nuclei template exists for this CVE. You can scan for it directly:

nuclei -id ghsa-53mr-6c8q-9789 -u https://target
Template
LiteLLM - Arbitrary File Read
Severity
high
Impact
Authenticated users can execute arbitrary code, read server files, and take over privileged accounts, leading to full system compromise.
Remediation
Update to version 1.83.0 or later.

Template by ProjectDiscovery nuclei-templates (theamanrawat), MIT licensed. View the full template. Scan only systems you are authorised to test.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant

This Important flaw in LiteLLM allows an authenticated user to bypass authorization on the `/config/update` endpoint. This enables modification of proxy configurations and environment variables, leading to remote code execution, unauthorized file access, and potential account takeover. Red Hat Ansible Automation…

Workaround published by Red Hat
Limit network access to the LiteLLM service to trusted networks or hosts only. Implement firewall rules to restrict inbound connections to the LiteLLM service's port, ensuring that only authorized systems can reach the service. This reduces the exposure of the `/config/update` endpoint to unauthorized authenticated users.
Source: Red Hat security advisory for GHSA-53mr-6c8q-9789 (CC BY 4.0)
ProductFixed inAdvisory
Red Hat Ansible Automation Platform 2.6ansible-automation-platform-26/lightspeed-chatbot-rhel9:1777398576RHSA-2026:13545
Red Hat OpenShift AI 2.25rhoai/odh-llama-stack-core-rhel9:1781826406RHSA-2026:28960
Red Hat OpenShift AI 3.3rhoai/odh-llama-stack-core-rhel9:1782310008RHSA-2026:30056

Frequently Asked Questions

### Impact The `/config/update endpoint` does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to do the following: - Modify proxy configuration and environment variables - Register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution - Read arbitrary server files by setting UI_LOGO_PATH and fetching via /get_image - Take over other priveleged accounts by overwriting UI_USERNAME and UI_PASSWORD environment variables ### Patches Fixed in v1.83.0. The en
O3 Security · Impact-Aware SCA

Is GHSA-53mr-6c8q-9789 in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works
LiteLLM: Privilege escalation via unrestricted proxy…