---
title: "Check Point found LiteLLM let any signed-in user seize admin; 97 million downloads a month"
description: "Check Point showed that any signed-in LiteLLM user could seize the admin account of the gateway holding a company's every model key, the latest receipt in a year of backdoors and botnets. The biggest customers are now rewriting the layer rather than upgrading it, and the free middle of the AI stack is becoming paid infrastructure."
publisher: "The Inference"
section: "Infrastructure"
published: 2026-10-21T14:46:50.005Z
modified: 2026-10-21T14:46:50.005Z
canonical: https://theinference.org/article/check-point-found-litellm-let-any-signed-in-user-seize-admin-97-million-downloads-a-month
language: en
keywords: "Cybersecurity, Open Source, AI Infrastructure, Supply Chain Security, Developer Tools"
---

# Check Point found LiteLLM let any signed-in user seize admin; 97 million downloads a month

> Check Point showed that any signed-in LiteLLM user could seize the admin account of the gateway holding a company's every model key, the latest receipt in a year of backdoors and botnets. The biggest customers are now rewriting the layer rather than upgrading it, and the free middle of the AI stack is becoming paid infrastructure.

The middle layer of the AI stack just failed as infrastructure, and the companies that depend on it have stopped upgrading and started rewriting. On October 13, [Check Point](https://theinference.org/markets/companies/check-point-software) Research, the research arm of the listed security firm, [disclosed two high-risk flaws](https://www.europapress.es/portaltic/ciberseguridad/noticia-check-point-descubre-dos-vulnerabilidades-alto-riesgo-litellm-herramienta-conecta-apps-ia-20261015125155.html) in [LiteLLM](https://theinference.org/markets/companies/litellm), the open-source gateway that routes a company's model traffic to [OpenAI](https://theinference.org/markets/companies/openai), [Anthropic](https://theinference.org/markets/companies/anthropic), Google and the rest, and showed that a user signed in with even a basic account could seize its admin controls [1][2].

A week later [Respan](https://theinference.org/markets/companies/respan), a startup that had spent two years building on LiteLLM, open-sourced a replacement it wrote from scratch [3]. This layer is turning from a free download into paid infrastructure, which is what it always was: a job.

## Every provider key sits behind one permission check

A gateway exists to concentrate. Applications get one OpenAI-style endpoint, and the gateway holds the credentials for every provider behind it. Enterprises self-host LiteLLM to keep those keys inside their own perimeter, and the scale is real: roughly 97 million downloads a month, with [Adobe](https://theinference.org/markets/companies/adobe) and NASA named by the project itself and [Netflix](https://theinference.org/markets/companies/netflix) on its adopter list [1][4].

Concentration cuts both ways. Check Point found that the endpoint which changes the gateway's runtime settings never checked whether the caller was an administrator, so a low-privileged user could reset the admin password, read files off the host and run code; the flaws are [reported fixed in version 1.83.9](https://pulse.adyog.com/insights/litellm-config-update-access-control-flaw) [2]. A second flaw let an attacker redirect model calls and capture the provider keys the gateway stores [5].

## Attackers moved to this layer before the market did

The pattern runs all year. In March, [malicious versions of the LiteLLM package on PyPI](https://www.bleepingcomputer.com/news/security/popular-litellm-pypi-package-compromised-in-teampcp-supply-chain-attack/), Python's package index, harvested cloud credentials until they were pulled [6]. In June, CISA, the US cyber agency, listed a LiteLLM command-injection flaw as actively exploited [7].

Since April, Lumen's Black Lotus Labs, the threat unit of the listed telecom, has [counted more than 3,400 hijacked servers](https://thehackernews.com/2026/10/poellm-malware-infects-3400-servers-to.html), mostly exposed LiteLLM and Ollama installs mining cryptocurrency, until the [GitHub](https://theinference.org/markets/companies/microsoft) repository whose poem encoded the botnet's command address disappeared and the campaign went quiet [8]. As Black Duck's Boris Cipot put it, attackers need not breach the model providers directly when the trusted software sitting between provider and customer is softer [5].

## Customers are rewriting the layer instead of upgrading it

Respan ran LiteLLM for thousands of organizations and wrapped it in more than 100,000 lines of its own code [3]. [A routine January upgrade broke connections](https://thenewstack.io/respan-rust-ai-gateway/), the cause was never found, and the team has backported fixes by hand ever since [3].

On October 20 it released the replacement: a Rust gateway with a small core where providers, protocols and security checks are all plugins, and a new provider is a 22-line file [3]. LiteLLM is making the same admission in its own direction, porting its server to Rust one route at a time behind an off-by-default flag [9], while [a maintainer apologized on Hacker News](https://news.ycombinator.com/item?id=50155214) for code quality [10].

The project has shipped more than 1,500 releases [4]; staying current with that treadmill is the work nobody budgeted for.

## The money moves to whoever can bill for the layer

The payers are the enterprises that treated the gateway as free and now buy audits, key rotation and, where exposed, miner cleanup. The collectors will be whoever turns the layer into maintained infrastructure: LiteLLM now sells an enterprise tier with custom support agreements and markets a Rust core [4], Respan sells the hosted version of its gateway [3], and every disclosure from Check Point and Lumen demonstrates the demand [1][8].

That reward is deserved. The models were never the bottleneck here; the pipe was, and whoever makes the pipe dependable is doing the work that turns AI capability into something a business can run on.

Keep adopting AI, and budget for the middle: this layer was never free, only unbilled.

## Takeaway

Check Point's October 13 disclosure showed any signed-in LiteLLM user could take over the admin of the gateway holding every provider key, and a year of backdoors and botnets has pushed customers like Respan to rewrite the layer in Rust rather than upgrade it: the free middle of the AI stack is becoming paid, maintained infrastructure.

## Sources

1. [Europa Press, Portaltic: Check Point descubre dos vulnerabilidades de alto riesgo en LiteLLM, 15 October 2026](https://www.europapress.es/portaltic/ciberseguridad/noticia-check-point-descubre-dos-vulnerabilidades-alto-riesgo-litellm-herramienta-conecta-apps-ia-20261015125155.html)
2. [WebPulse by Adyog: A low-level LiteLLM account could take over the AI gateway, Check Point finds, 13 October 2026](https://pulse.adyog.com/insights/litellm-config-update-access-control-flaw)
3. [Respan (YC W24), Launch HN: Open-source Rust AI gateway built around plugins, Hacker News, 20 October 2026](https://news.ycombinator.com/item?id=50167583)
4. [BerriAI/litellm GitHub repository, accessed 21 October 2026](https://github.com/BerriAI/litellm)
5. [Hackread: Check Point Reports LiteLLM Flaws Enabling Admin Takeover and API Key Theft, 14 October 2026](https://hackread.com/check-point-litellm-flaws-admin-takeover-api-key-theft/)
6. [BleepingComputer: Popular LiteLLM PyPI package backdoored to steal credentials, auth tokens, 24 March 2026](https://www.bleepingcomputer.com/news/security/popular-litellm-pypi-package-compromised-in-teampcp-supply-chain-attack/)
7. [9to5AI: PoeLLM Malware Hits Exposed Ollama and LiteLLM Servers, October 2026](https://9to5ai.tech/poellm-malware-exposed-ollama-litellm-servers)
8. [The Hacker News: PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet, 7 October 2026](https://thehackernews.com/2026/10/poellm-malware-infects-3400-servers-to.html)
9. [The New Stack: Respan spent two years building on LiteLLM. One upgrade made it start over., 20 October 2026](https://thenewstack.io/respan-rust-ai-gateway/)
10. [Hacker News comment by ij23 (LiteLLM maintainer), 19 October 2026](https://news.ycombinator.com/item?id=50155214)


---

Check Point found LiteLLM let any signed-in user seize admin; 97 million downloads a month — The Inference. Canonical: https://theinference.org/article/check-point-found-litellm-let-any-signed-in-user-seize-admin-97-million-downloads-a-month