{"id":228,"date":"2026-10-29T07:23:14","date_gmt":"2026-10-29T07:23:14","guid":{"rendered":"https:\/\/bugskan.com\/?p=228"},"modified":"2026-10-29T07:23:15","modified_gmt":"2026-10-29T07:23:15","slug":"litellm-configuration-endpoint-lacked-an-administrator-role-check","status":"publish","type":"post","link":"https:\/\/bugskan.com\/index.php\/2026\/10\/29\/litellm-configuration-endpoint-lacked-an-administrator-role-check\/","title":{"rendered":"LiteLLM configuration endpoint lacked an administrator-role check"},"content":{"rendered":"<p>The LiteLLM advisory describes missing administrator authorization on the proxy configuration-update endpoint. An authenticated user could change configuration and environment values that should have required a proxy administrator.<\/p>\n<p>The documented consequences include file access, account takeover and code execution through configurable handlers. The prerequisite is an authenticated platform user, rather than an unrestricted claim that every proxy was remotely compromised.<\/p>\n<p>The advisory lists 1.83.0 as fixed. Upgrade to a maintained release and review unexpected configuration changes. Limit who receives API access, while recognizing that reducing key distribution does not replace the missing role check.<\/p>\n<p><a href=\"https:\/\/osv.dev\/vulnerability\/GHSA-53mr-6c8q-9789\">Read the original source<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>CVE-2026-35029 could let an authenticated user change privileged proxy configuration; version 1.83.0 added the required check.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"bugskan_incident_id":"inc_a460b71b0b3143","bugskan_event_type":"vulnerability","bugskan_response":"REVIEW","bugskan_technical_severity":"","bugskan_technical_severity_source":"","bugskan_evidence_quality":"high","bugskan_affected_scope":"Affected LiteLLM releases below 1.83.0.","bugskan_recommended_next_step":"Update LiteLLM and investigate unauthorized configuration or environment changes.","bugskan_who_should_check":"","bugskan_material_updated_at":"2026-04-03T00:00:00Z","bugskan_reviewer_name":"","bugskan_reviewed_at":"","bugskan_legacy_state":"mapped","bugskan_featured":false,"bugskan_sample":false,"footnotes":""},"categories":[1],"tags":[],"bugskan_format":[2],"bugskan_technology":[21],"class_list":["post-228","post","type-post","status-publish","format-standard","hentry","category-uncategorized","bugskan_format-security-brief","bugskan_technology-litellm"],"_links":{"self":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/228","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/comments?post=228"}],"version-history":[{"count":1,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/228\/revisions"}],"predecessor-version":[{"id":387,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/228\/revisions\/387"}],"wp:attachment":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/media?parent=228"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/categories?post=228"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/tags?post=228"},{"taxonomy":"bugskan_format","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/bugskan_format?post=228"},{"taxonomy":"bugskan_technology","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/bugskan_technology?post=228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}