Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bundles
2026-11-03T20:52:17Z•91b075655a7178ed05278a58e0c9c61498434cc94d9b5a466abfd46b09559c73
CVE-2026-35029CVE-2026-59823AI securityCobalt StrikeLLM gatewayLiteLLMauthorization bypassconfiguration tamperinginfostealermalware distributionopen-source softwareprivilege escalationprompt injection
What happened
Check Point Research reports that LiteLLM v1.77.7, an open-source LLM gateway, contained multiple high-impact authorization vulnerabilities, including missing access controls on /config/update. Low-privileged authenticated users could modify gateway configuration, potentially enabling unauthorized model/provider changes and further compromise. The issues are tracked as CVE-2026-35029 and CVE-2026-59823 and were fixed in LiteLLM 1.83.9. The feed also highlights emerging AI-focused threats, including prompt adware in jailbreak bundles, malware distributed as fake signed ChatGPT/Claude binaries,
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- checkpoint_research
- Record identifier
- 91b075655a7178ed05278a58e0c9c61498434cc94d9b5a466abfd46b09559c73
- Enrichment time
- 2026-11-03T20:52:17Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.