Almost one in 10 internet-exposed LiteLLM AI gateways accepted the broadly documented default grasp key, sk-1234, or required no authentication, making a direct path to LLMjacking, delicate credential publicity, and in susceptible variations root-level code execution contained in the gateway container.
Their web scan of three,074 publicly reachable cases discovered that 294 methods, or 9.6%, accepted the default key; 191 cases, or 6.2%, had no authentication enabled.
Essentially the most extreme externally reachable challenge, tracked as CVE-2026-59822, impacts LiteLLM’s Mannequin Context Protocol (MCP) Streamable HTTP endpoint.
Earlier than LiteLLM 1.84.0, an attacker might provide an arbitrary Bearer token and set off an OAuth2 fallback path that transformed a failed API-key validation into an empty authenticated person object.
In observe, even a single-character token might set up a sound MCP session and attain configured MCP instruments with out a reputable LiteLLM key.
That issues as a result of MCP servers typically expose actions, not simply knowledge. Relying on deployment configuration, a compromised gateway might present entry to inner databases, source-code repositories, ticketing methods, Slack workspaces, file shops, CI/CD tooling, and different related enterprise companies.
The flaw has been added to CISA’s Recognized Exploited Vulnerabilities catalog, indicating exploitation has been noticed within the wild.
A second challenge, CVE-2026-59821, affected LiteLLM’s Customized Code Guardrails function.
The manufacturing create and replace endpoints beforehand compiled and executed submitted Python code with out making use of the sandboxing and dangerous-pattern validation enforced by the UI testing workflow.
Wiz researchers recognized a number of flaws affecting LiteLLM, the open-source gateway used to centralize entry to LLM suppliers comparable to OpenAI, Anthropic, AWS Bedrock, Azure, and Google Vertex AI.
LiteLLM AI Gateways
A privileged person able to creating or modifying a guardrail might execute Python within the LiteLLM proxy setting, doubtlessly exposing course of secrets and techniques and operating instructions with the permissions of the service container.
The difficulty impacts variations previous to 1.82.0-stable and has been mounted in 1.82.0-stable.
The Net UI’s “Run Take a look at” button validates code towards a forbidden patterns checklist and strips __builtins__ earlier than execution, blocking import, os, subprocess, and related. However the registration endpoint (POST /guardrails) applies neither safety.
Within the researchers’ proof of idea, code executed throughout guardrail registration and returned uid=0(root) from the LiteLLM container.
The sensible severity is dependent upon the container’s runtime configuration, mounted secrets and techniques, Kubernetes service-account tokens, community reachability, and cloud IAM function permissions.
Root inside a container will not be robotically root on the host, however it might probably nonetheless characterize a high-impact foothold in an AI or cloud setting.
The danger turns into considerably worse when organizations go away LiteLLM’s grasp key unchanged or run the service with no authentication.
Traditionally, LiteLLM handled a lacking grasp key as unauthenticated entry and, earlier than the related repair, assigned incoming requests the PROXY_ADMIN function.
This might flip uncovered cases into remotely manageable administrative gateways slightly than easy unauthenticated API proxies.
LiteLLM subsequently modified the default unauthenticated function and added stronger admin checks for guardrail operations.
Researchers additionally highlighted a cloud credential-theft situation involving LiteLLM pass-through endpoints. The function permits directors to proxy requests to specified URLs, together with inner addresses.
If an attacker obtains administrative entry, they may configure a route focusing on cloud metadata companies comparable to AWS EC2 IMDS at 169.254.169.254 and retrieve non permanent IAM credentials.
Though this habits is framed as an administrative functionality slightly than a standalone vulnerability, it turns into harmful when administrative entry is obtained by way of default credentials, absent authentication, or one other authorization flaw.
A associated authorization challenge, CVE-2026-35029, allowed authenticated customers to use lacking authorization checks on LiteLLM’s /config/replace endpoint.
Pink Hat says the flaw might allow proxy and environment-variable adjustments, doubtlessly resulting in distant code execution, unauthorized server-file entry, and privileged-account takeover.
Organizations working LiteLLM ought to improve instantly to not less than model 1.84.0 to deal with the MCP authentication bypass and guarantee they’re operating 1.82.0-stable or later for the Customized Code Guardrails repair.
They need to additionally assessment whether or not CVE-2026-35029 remediation is current of their deployed launch.
Directors ought to exchange sk-1234 with a robust, distinctive grasp key; disable or tightly prohibit /mcp/ entry if MCP will not be important; audit configured MCP servers and power permissions; examine current guardrails and pass-through routes.
LiteLLM gateways ought to be handled as Tier-1 infrastructure. They sit between utility workloads, mannequin suppliers, cloud credentials, prompts, inner instruments, and automation methods making a poorly secured gateway much more priceless to attackers than a traditional API proxy.
★ Be taught 7 Metric-Gated AI SOC Deployment Phases – Obtain Free AI SOC Deployment Playbook 2026.
