LiteLLM, an AI gateway that forwards requests to large language model APIs, contains a /config/update endpoint that accepts configuration changes without verifying the caller’s administrative privileges. This allows an authenticated user to modify proxy settings, environment variables, and register custom pass‑through handlers that execute attacker‑controlled Python code. As a result the attacker can achieve remote code execution, read arbitrary server files by setting UI_LOGO_PATH and retrieving the image, and impersonate privileged accounts by overriding UI_USERNAME and UI_PASSWORD. The vulnerability is a classic case of elevated privilege leading to arbitrary code execution, a high‑severity weakness reflected in the CVSS score of 8.7.

The affected product is BerriAI’s LiteLLM, available before version 1.83.0. Any deployment of LiteLLM older than v1.83.0 that exposes the /config/update endpoint is vulnerable. The CVE description does not list additional vendors or downstream distributions, so only the primary LiteLLM product is mentioned.

This flaw scores 8.7 on the CVSS scale and has an EPSS of 13%, indicating a notable probability of exploitation in the wild. It is not enumerated in the CISA KEV catalog, but the potential impact of remote code execution makes it a high‑risk issue for any environment where LiteLLM is accessible. The exploit requires an already authenticated user; an attacker who can log in—whether legitimately or through credential compromise—can immediately trigger the vulnerability. No additional conditions are required beyond authentication, making the attack relatively straightforward once access is obtained.