Check Point Research disclosed two critical vulnerabilities in the open-source LiteLLM AI gateway around October 14, 2026. CVE-2026-35029 is a missing access-control check on an admin-only configuration endpoint that lets a low-privilege user read server files, overwrite administrator credentials, and execute code on the host. CVE-2026-59823 is a server-side request forgery in the gateway’s client-side credentials feature that can redirect outbound requests to an attacker-controlled server and capture OpenAI, Anthropic, and Google API keys passed through the proxy. Both issues are fixed in LiteLLM version 1.83.9, and no in-the-wild exploitation had been reported at disclosure.