A critical authorization flaw in BerriAI LiteLLM allows authenticated attackers to gain remote code execution, access arbitrary files, and perform full account takeovers.

The vulnerability stems from an incorrect authorization check (CWE-863) within the /config/update endpoint. Any authenticated user can bypass intended role restrictions to modify environment variables, register malicious Python handlers, or overwrite administrative credentials.

Successful exploitation of this vulnerability results in full system compromise, as the attacker can achieve remote code execution and gain administrative control over the AI gateway. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to unauthorized data exfiltration, the manipulation of AI pipeline outputs, and complete loss of confidentiality and integrity for the proxy server.

Immediate Action: Update the LiteLLM package to version 1.83.0 or higher immediately to apply the required authorization checks.

Proactive Monitoring: Review application logs for unexpected access to the /config/update endpoint and monitor for unauthorized changes to environment variables or the registration of new custom handlers.

Compensating Controls: Implement strict network access controls to limit access to the LiteLLM administrative interface to trusted IP addresses only, and utilize a WAF to inspect incoming traffic for suspicious payloads targeting configuration endpoints.

Public Exploit Available: Yes — public proof-of-concept repositories are available on GitHub.

Due to the potential for full remote code execution and administrative account takeover, this vulnerability poses a severe threat to any environment hosting LiteLLM. Organizations must prioritize upgrading to version 1.83.0 immediately. If an update cannot be performed instantly, restrict network access to the proxy server to minimize the attack surface until the patch is deployed.