CVE-2026-35029: Non-Admin Configures LiteLLM Pass-Through Endpoint

Arnold Chan@slaz

•updated Sep 12, 2026•0•0•2

Detects attempts by non-privileged (non-PROXY_ADMIN) API keys to modify pass-through routes in LiteLLM via configuration update endpoints. This activity is indicative of exploitation of CVE-2026-35029, which allows unauthenticated or low-privilege users to bypass configuration restrictions.