ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
AI model

Anthropic

1 mentions in 7 days · 3 in 30 days · 3 total · first seen · last

Search everything

Timeline

Hackers Can Turn Vulnerable LiteLLM AI Gateways Into Root Access and Cloud Credential Theft

Wiz found multiple LiteLLM AI gateway flaws, including a CVE-2026-59822 MCP auth bypass added to CISA KEV, enabling root code execution and cloud credential theft.

An internet scan of 3,074 exposed LiteLLM instances found 294 (9.6%) accepting the default sk-1234 master key and 191 (6.2%) requiring no authentication. CVE-2026-59822 lets a single-character Bearer token establish a valid MCP session via an OAuth2 fallback in versions before 1.84.0; the flaw is in CISA's Known Exploited Vulnerabilities catalog. CVE-2026-59821 allows Python code execution as root in the gateway container via unsanitized Custom Code Guardrails registration before 1.82.0-stable, and CVE-2026-35029 permits config changes leading to RCE and admin takeover. Admin access plus pass-through endpoints can reach cloud metadata services to steal IAM credentials.

GBHackers · 5d agoAI safety & security in the wild 4 sourcesCVE-2026-59822CVE-2026-59821CVE-2026-35029

LiteLLM Supply-Chain Attack - Technology, Banking and Healthcare the Most Affected

TeamPCP planted the SANDCLOCK credential stealer in LiteLLM PyPI releases, exposing credentials across 2,038 repositories at 898 organizations including Microsoft and NVIDIA.

Threat actor TeamPCP compromised LiteLLM maintainer credentials and published malicious versions 1.82.7 and 1.82.8 to PyPI around March 2026, creating an exposure window of several months. The SANDCLOCK credential stealer exposed full credential sets across 898 GitHub owners and 2,038 repositories, including Microsoft, Azure, IBM, NVIDIA, PayPal, Deloitte, Bosch, and S&P Global. Stolen material includes GitHub CI/CD identities, AWS/GCP/Firebase credentials, SSH keys, Kubernetes secrets, and OpenAI and Anthropic API keys; Resecurity acquired a 150GB archive with 2,146 credential records. Technology, banking/finance, and healthcare organizations are the most affected sectors, and victims must rotate all exposed credentials.

Security Affairs · 29d agoMalware in the wild

Bad Likert Judge: A Novel Multi-Turn Technique to Jailbreak LLMs by Misusing Their Evaluation Capability

Unit 42 details the Bad Likert Judge multi-turn jailbreak that abuses LLMs' evaluation capability, raising attack success rates over 60% across six frontier models.

Palo Alto Networks Unit 42 describes the Bad Likert Judge technique, a multi-turn jailbreak that asks a target LLM to act as a Likert-scale judge scoring the harmfulness of example responses. The highest-rated example in each scale can carry harmful content, bypassing the model's internal guardrails. Testing across six state-of-the-art text-generation LLMs showed an average attack success rate increase of more than 60% versus plain attack prompts, with tested models anonymized. The technique targets edge cases rather than typical use, and the article positions the work as guidance for defenders on potential jailbreak risks.

Palo Alto Unit 42 · 29d agoAI safety & security

Related CVEs

  • CVE-2026-598228.8<1%
    Unauthenticated MCP Endpoint Authentication Bypass in BerriAI LiteLLM
    BerriAI LiteLLM, a widely used self-hosted AI gateway and proxy server for calling LLM APIs, fails to properly authenticate requests to its MCP Streamable HTTP endpoint in versions prior to 1.84.0. An unauthenticated attacker can send a fabricated Authorization header that triggers an OAuth2 passthrough fallback, which replaces failed LiteLLM key validation with an empty UserAPIKeyAuth() object and lets the request reach MCP tooling without any valid LiteLLM key. Successful exploitation grants unauthenticated access to the gateway's MCP tooling with high confidentiality impact per the CVSS 4.0 score of 8.8, and public reporting describes attackers chaining LiteLLM weaknesses from authentication bypass to root code execution and cloud credential theft. Any organization running LiteLLM before 1.84.0 is affected, particularly gateways exposed to the internet. The flaw is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-02, while EPSS currently estimates a 0.9% probability of exploitation in the next 30 days.
    · BerriAI LiteLLM all versions prior to 1.84.0 (fixed in 1.84.0) KEVmoderate
  • CVE-2026-350298.725%
    Broken Access Control in LiteLLM AI Gateway Enables Authenticated RCE
    CVE-2026-35029 is a broken access control flaw (CWE-863, CWE-425) in LiteLLM, an open-source proxy server (AI Gateway) for calling LLM APIs, in which the /config/update endpoint fails to enforce admin-role authorization in versions prior to 1.83.0. Any user who is already authenticated to the proxy can call this network-accessible endpoint without admin rights and modify the proxy configuration and environment variables. Through this, an attacker can achieve remote code execution by registering pass-through endpoint handlers that point to attacker-controlled Python code, read arbitrary server files by setting UI_LOGO_PATH and fetching the file via /get_image, and take over other privileged accounts by overwriting the UI_USERNAME and UI_PASSWORD environment variables; related security coverage also highlights that vulnerable LiteLLM gateways can be turned into root-level code execution and cloud credential theft. Any organization running a LiteLLM proxy older than v1.83.0 is affected, particularly deployments where non-admin users hold authenticated accounts. No public proof-of-concept or confirmed in-the-wild exploitation is known and the flaw is not in CISA KEV, but EPSS assigns a 25.1% probability of exploitation within 30 days (98th percentile), signaling elevated near-term risk.
    · LiteLLM proxy server (AI Gateway) all versions prior to 1.83.0; fixed in v1.83.0moderate
  • CVE-2026-598212.1<1%
    LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format.
    LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to create or update guardrails to submit custom Python code that executed in the LiteLLM proxy environment and could expose secrets available to the process. This issue is fixed in version 1.82.0-stable.
    · litellm litellm—

Appears with

ai model OpenAI 2vendor LiteLLM 2product LiteLLM 2ai model Azure 1ai model Google Vertex AI 1organization CISA 1organization PyPI 1organization Red Hat 1organization Resecurity 1organization Wiz 1product Bad Likert Judge 1vendor AWS 1vendor Palo Alto Networks 1vendor Red Hat 1vendor Unit 42 1vendor Wiz 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.