The report
Two vulnerabilities disclosed in detail by Check Point on October 13 affect LiteLLM's role as a gateway between applications and model providers. The first allowed non-administrative users to change sensitive proxy configuration. In testing, the effect could be extended to file access, credential modification and server-side Python loading. The second accepted a nested routing parameter that redirected provider calls toward an attacker-specified host with the proxy's stored credentials attached.
These are distinct mechanisms. One crosses the administrative control plane, while the other changes where the data plane sends a privileged request. Both require an authenticated lower-privilege actor in the described setup; neither demonstrates an anonymous internet-wide compromise. The researchers report fixes in LiteLLM 1.83.9.
Detailed records: configuration bypass and provider-key routing.
These two routes should be tested independently. An authenticated configuration mutation relies on administrative authority granted to a lower-privileged user; nested destination control relies on the proxy adding its credentials to an attacker-selected provider route. Blocking one parameter name does not prove the other boundary is enforced.
Two independent validation points
A proxy can have perfectly legitimate provider keys yet mishandle who is allowed to change configuration. That is the first flaw. In the second, a nested routing value influences the destination of a privileged provider call even though the user should not control the destination receiving the gateway's credentials. A permissions test that probes only top-level request fields would miss a nested override, while a destination allowlist cannot compensate for an administrative endpoint writable by ordinary users.
Operators evaluating a fixed deployment should verify their installed LiteLLM version and test both the administrative endpoint and the complete effective provider-routing object. A vendor-reported fix in 1.83.9 does not prove every downstream fork or configuration was updated. The supplied research does not establish a production theft campaign or the number of affected installations.