Is LiteLLM Safe to Use? What the 2026 Security Incidents Mean for Your AI Stack

Is LiteLLM safe to use right now?

The short answer: Do not run LiteLLM 1.107.0. On October 21, 2026, LiteLLM 1.107.0 shipped malware on PyPI and in the Docker tags latest and main-stable. Pin LiteLLM to 1.106.2 by digest. If any host ran 1.107.0, rotate every secret that host could reach.

In 2026, LiteLLM shipped malware twice, in March and in October. LiteLLM also had at least six CVEs. CISA lists two of them as exploited.

The larger question for enterprise teams is different. An AI gateway sits in the request path of every AI call and stores every provider key. Teams need to know how many gateway copies they run, who patches each copy, and how fast each patch happens.

Which LiteLLM versions are affected?

What happened in the October 21, 2026 LiteLLM 1.107.0 attack?

On October 21, 2026, LiteLLM published version 1.107.0 with malware. The malware was on PyPI and in the Docker tags v1.107.0, latest, main-latest, and main-stable. Attackers used stolen GitHub tokens from three LiteLLM engineers to run the release.

The malware runs when Python starts. It steals cloud keys, SSH keys, AI tool logins, and environment variables. It also reads provider keys from the LiteLLM database. A second part waits for more code to download and run.

LiteLLM says to assume the theft worked if 1.107.0 ran on a host with internet access (LiteLLM advisory).

Who was affected by the October 21 attack?

• Anyone who installed LiteLLM from PyPI without a pinned version on October 21, 2026.
• Anyone who pulled the latest, main-latest, or main-stable Docker tag that day.
• LiteLLM says users of its private enterprise release were not affected.

What did Check Point find in LiteLLM in October 2026?

Check Point Research found two flaws in LiteLLM and published the findings on October 13, 2026. Check Point says anyone with an account on a vulnerable LiteLLM gateway could use the flaws. Check Point reported both flaws to LiteLLM in October 2025, and LiteLLM fixed both in version 1.83.9.

What is CVE-2026-35029?

CVE-2026-35029 is an access control flaw with a severity score of 8.7 out of 10 (high). LiteLLM gives administrators full control and gives other users limited or read-only access. Because of the flaw, a user with minimal access could reach admin functions. In a test setup, Check Point showed that an attacker could:

• Read files on the server, including configuration files.
• Replace the admin credentials with their own and lock out real admins.
• Make the gateway download and run code from an outside source.

What is CVE-2026-59823?

CVE-2026-59823 is a server-side request forgery (SSRF) flaw with a severity score of 5.3 out of 10 (medium). A gateway user could give LiteLLM a destination that the attacker controls. LiteLLM then created a route to that server without checking the destination. The requests carried the API keys that LiteLLM uses with AI providers, so the attacker received the keys. With those keys, an attacker can use the organization’s AI accounts and add costs to the organization’s bill.

Which LiteLLM CVEs are on CISA’s exploited list?

Two LiteLLM CVEs are on CISA’s Known Exploited Vulnerabilities list. CVE-2026-42271 lets any API key holder run commands on the host. CISA added it on June 8, 2026. CVE-2026-59822 lets an attacker open an MCP session with any bearer token. CISA added it on September 2, 2026.

What happened in the March 2026 supply chain attack?

On March 24, 2026, two versions of the litellm package on PyPI (1.82.7 and 1.82.8) contained malicious code. The threat actor, known as TeamPCP, did not break into the LiteLLM code directly. TeamPCP first compromised Trivy, a security scanner in LiteLLM’s CI/CD pipeline, and used that access to get a maintainer’s PyPI credentials (Snyk analysis).

The malware stole credentials. According to Trend Micro’s research, the malware collected environment variables, SSH keys, cloud credentials, and system information, then sent the data to servers the attackers controlled. The malware also installed a backdoor that checked for more malware every 50 minutes.

Two facts made the March attack serious:

1. The code ran on every Python start. A malicious .pth file ran whenever Python started in that environment, even if no code imported LiteLLM (NHS England cyber alert CC-4761).
2. Many systems install LiteLLM. LiteLLM had about 3.4 million downloads per day at the time.

Who was affected by each event?

March 2026 attack:

• Affected: Anyone who installed litellm 1.82.7 or 1.82.8 from PyPI in the roughly three hours before PyPI quarantined the packages. Systems that pulled those versions through CI/CD or other dependencies were also affected.
• Not affected in March: Users of the official LiteLLM Proxy Docker image, according to LiteLLM’s advisory.

October 2026 CVEs:

• Affected: Every LiteLLM deployment before version 1.83.9. The October flaws are in LiteLLM’s own code, so the install method does not change the risk.
• Easy to miss: Check Point says many platforms and internal tools include LiteLLM. A team can run LiteLLM without ever deploying LiteLLM on purpose.

What should LiteLLM users do now?

Take these six steps. Steps 2 to 6 follow Check Point’s advice.

1. Find every LiteLLM copy. Search code, container images, and CI/CD configs for litellm. Check AI platforms and internal tools that may include LiteLLM.
2. Pin every copy to 1.106.2 by digest. Do not pull the latest or main-stable tags. Record the version and digest of each copy.
3. Review user accounts. Any account could use these flaws. Remove accounts that nobody needs.
4. Test permissions. Sign in as a limited user and confirm that admin functions are blocked.
5. Rotate AI provider keys if anyone may have had unauthorized access before the update.
6. Add AI gateways to security tests. Include LLM gateways in penetration tests and vulnerability scans, next to web apps and cloud systems.

What do these events show about AI gateway risk?

An AI gateway is one of the most valuable targets in a company’s systems, for three reasons:

1. The gateway sits in the request path of every AI call. Prompts, responses, and sensitive data pass through the gateway.
2. The gateway stores every provider key. OpenAI, Anthropic, Amazon Bedrock, and Google Vertex AI keys live in the gateway.
3. The gateway runs in many places. Developer laptops, CI pipelines, and production clusters can all run a copy.

Check Point notes that both October flaws are common types of security bugs. AI software now faces the same risks as other enterprise software. Any gateway can have bugs like these, including ours. Ask these questions of any AI gateway:

• How is the release pipeline secured? Are releases signed?
• Is there a foundation, a security team, and a disclosure process behind the code?
• How many gateway copies does your team patch, and who tells you when a fix is ready?
• How fast can you rotate provider keys?
• Can the gateway run inside your own VPC or data center?

If these events are a reason to review your gateway, see our step-by-step LiteLLM migration guide. The migration does not require application rewrites, and the LiteLLM vs Tetrate comparison covers the differences.

How does Tetrate approach AI gateway security?

Tetrate Agent Router Enterprise is built on Agent Router, formerly Envoy AI Gateway. Tetrate co-created the open source project with Bloomberg and donated the project to the Agentic AI Foundation under the Linux Foundation in September 2026.

• Foundation governance. Agent Router is Apache 2.0 open source under the Linux Foundation, with community-led development and no paid-only code paths.
• Envoy underneath. Envoy has faced the open internet since 2016 and has a public security process.
• Built by its co-creators. Tetrate ships enterprise builds of code that Tetrate co-created and maintains.
• Tetrate patches the management plane. Tetrate runs and updates the management plane. Your team updates data planes with Helm, GitOps, or the CLI.
• Data planes in your network. Data planes run in your own AWS, Azure, or Google Cloud VPC or on-premises. Each data plane connects out to Tetrate, and nothing connects in.

For a wider view of how AI gateways compare in 2026, see our 2026 enterprise AI gateway comparison.

Frequently asked questions

Is LiteLLM affected by CVE-2026-35029 and CVE-2026-59823? Yes. Every LiteLLM version before 1.83.9 has both flaws. CVE-2026-35029 lets a low-privilege user reach admin functions. CVE-2026-59823 can send AI provider API keys to an attacker’s server.

Which LiteLLM version fixes CVE-2026-35029 and CVE-2026-59823? LiteLLM 1.83.9 fixes both flaws. Later releases fixed more CVEs, so use 1.106.2.

Which LiteLLM versions contained malware? Versions 1.82.7 and 1.82.8 on PyPI, published March 24, 2026, and version 1.107.0, published October 21, 2026. The 1.107.0 malware was also in the Docker tags v1.107.0, latest, main-latest, and main-stable.

What should I do if I installed an affected version? For the March malware versions, uninstall the package and treat every credential on the system as compromised. Rotate API keys, cloud credentials, and SSH keys, and check for backdoors. For the October CVEs, update to 1.83.9 or later, review user accounts, and rotate provider keys if anyone may have had unauthorized access.

How do I find LiteLLM running inside other tools? Search code, container images, and dependency lists for litellm. Ask the owners of internal AI tools and AI platforms whether their products include LiteLLM. Check Point warns that LiteLLM often runs inside other platforms.

Is LiteLLM 1.107.0 safe? No. LiteLLM 1.107.0 contains malware that steals credentials. Use 1.106.2, pinned by digest.

Were LiteLLM Docker images affected? Yes, on October 21, 2026. The tags v1.107.0, latest, main-latest, and main-stable served the malware. In March 2026, the Docker images were not affected.

If you are checking your exposure or planning a change of gateway, talk to our team.

Sources

• Check Point Research, “Check Point Research Discovers High Risk Vulnerabilities in LiteLLM,” October 13, 2026: https://blog.checkpoint.com/security/check-point-research-discovers-high-risk-vulnerabilities-in-litellm-one-of-the-most-widely-used-llm-gateways/
• Check Point Research, full technical findings: https://research.checkpoint.com/2026/when-llm-gateways-go-wrong-findings-from-litellm/
• NVD, CVE-2026-35029: https://nvd.nist.gov/vuln/detail/cve-2026-35029
• NVD, CVE-2026-59823: https://nvd.nist.gov/vuln/detail/cve-2026-59823
• PyPI, litellm release history: https://pypi.org/project/litellm/#history
• LiteLLM security advisory (March 2026): https://docs.litellm.ai/blog/security-update-march-2026
• LiteLLM v1.83.0 release notes: https://docs.litellm.ai/release_notes/v1.83.0/v1-83-0
• Snyk, “How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM”: https://snyk.io/blog/poisoned-security-scanner-backdooring-litellm/
• Trend Micro Research, “Inside the LiteLLM Supply Chain Compromise”: https://www.trendmicro.com/en_us/research/26/c/inside-litellm-supply-chain-compromise.html
• NHS England cyber alert CC-4761: https://digital.nhs.uk/cyber-alerts/2026/cc-4761
• LiteLLM, “Oct 21, 2026 LiteLLM release v1.107.0 Compromised”: https://docs.litellm.ai/blog/security-incident-oct-21-2026
• CISA, Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• NVD, CVE-2026-59822: https://nvd.nist.gov/vuln/detail/CVE-2026-59822