The gateway that routes your company's AI traffic just got caught with the door unlocked.
Check Point Research found two flaws in LiteLLM, the open-source gateway that lets apps talk to more than 140 AI providers through one interface. The first, CVE-2026-35029, is a broken access-control check that lets a user with minimal privileges reach admin-only functions, read files off the server, overwrite admin credentials, and run malicious code. It scored 8.7 out of 10. The second, CVE-2026-59823, is a server-side request forgery bug that lets a gateway user redirect API calls to a server they control, handing over the AI provider keys attached to those requests. LiteLLM fixed both in version 1.83.9.
What makes this one sting is the install base: 90 million monthly downloads and 61,000 GitHub stars, plus the fact that LiteLLM often ships bundled inside other platforms rather than deployed on its own. That means plenty of teams running it have no idea they're exposed, because nobody on staff deployed it directly. This is the same pattern that made past reverse-proxy and API-gateway bugs so costly: the flaw sits one layer below the apps people actually audit.
A stolen AI provider key is just a billing problem wearing a security-incident costume - until someone uses it to run up someone else's OpenAI or Anthropic bill, or worse, reads whatever files the admin takeover exposes. Check Point's advice is blunt: patch, rotate every key that gateway touched, and start treating AI infrastructure like the production software it already is.