Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
1 IOC
Hackers Exploit LiteLLM Admin API Flaw to Turn Read-Only Access Into Full Server Takeover
Excerpt
A broken authorization check in LiteLLM’s administrative API is being actively targeted, allowing attackers with even read-only access to alter gateway settings, expose secrets, and seize administrator control. Zenity observed exploitation attempts against CVE-2026-35029, a broken-access-control vulnerability affecting LiteLLM’s /config/update endpoint. The flaw, disclosed on April 6, 2026 and fixed in LiteLLM version 1.83.0, enables accounts assigned the supposedly limited…
Read the original report →Indicators of Compromise
Open the mindmap →1 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-35029 | Medium | Score 56/100 | First seen |
IOC Relationship Graph
Building graph…