LiteLLM Flaws Let Attackers Execute Code as Root and Steal Cloud Credentials
Wiz disclosed LiteLLM flaws including CVE-2026-59822 MCP auth bypass, now in CISA KEV, enabling root RCE and AWS credential theft from exposed gateways.
Wiz researchers disclosed weaknesses in the open-source LiteLLM AI gateway: CVE-2026-59821 allows authenticated administrators to execute code as root via the Custom Code Guardrails feature, while CVE-2026-59822 is an MCP authentication bypass where a meaningless Bearer token establishes a valid session. The MCP bypass was observed in the wild through Wiz honeypots and added to CISA's Known Exploited Vulnerabilities catalog on September 2. A scan of 3,074 internet-facing instances found 294 (9.6%) accepting the default master key sk-1234 or lacking authentication. Fixes shipped in LiteLLM 1.82.0 (guardrail hardening) and 1.84.0 (MCP bypass); exposed instances can leak provider API keys and temporary AWS IAM credentials via the pass-through feature and metadata service, with a related config-check issue tracked as CVE-2026-35029.
- CVE-2026-35029 covers missing administrator checks on pass-through endpoint configuration before version 1.83.0.
- With admin access, attackers can abuse pass-through forwarding to reach the cloud metadata service and obtain AWS IAM credentials.
- Recommended mitigations: replace the sk-1234 default key, restrict outbound traffic, rotate provider keys, and review logs.
- Indicators include the /mcp/ and /guardrails endpoints, the minimal Bearer token, and affected source files.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-35029 | Broken Access Control in LiteLLM AI Gateway Enables Authenticated RCE | 8.7 | 25% | ||
| CVE-2026-59821 | LiteLLM: LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the… | 2.1 | <1% | ||
| CVE-2026-59822 | Unauthenticated MCP Endpoint Authentication Bypass in BerriAI LiteLLM | 8.8 | <1% | KEV | KEV |
From the original article
4 min read at cybersecuritynews.com
LiteLLM deployments can expose far more than an organization’s AI spending. Newly disclosed weaknesses in the open-source gateway could let attackers run code as root inside a container, reach connected tools, and retrieve cloud credentials that open a path into a wider environment. The risk is serious where the service is internet-facing or retains its […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.