Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise
Wiz found LiteLLM auth bypass (CVE-2026-59822) and post-auth RCE (CVE-2026-59821) chainable to cloud compromise; the bypass is in CISA KEV with in-the-wild exploitation.
Wiz scanned roughly 3,074 internet-facing LiteLLM deployments and found 9.6% accepted the default master key sk-1234 or required no authentication, making post-auth attacks effectively pre-auth. The MCP endpoint accepts any Bearer token and grants a valid session (CVE-2026-59822), confirmed exploited in the wild via honeypots and added to CISA's Known Exploited Vulnerabilities catalog. Custom code guardrails allow post-auth root-level RCE via exec(compile(...)) (CVE-2026-59821), while pass-through endpoints lack URL validation, enabling cloud credential theft in post-auth scenarios. All assigned vulnerabilities have been patched; the research was presented at DEF CON 34.
- CVE-2026-59822: MCP endpoint accepts arbitrary Bearer tokens, creating fully authenticated sessions
- CVE-2026-59821: post-auth root RCE via custom code guardrails using exec(compile(...))
- 9.6% of 3,074 public instances use default key sk-1234 or no authentication
- CVE-2026-59822 added to CISA KEV; honeypots observed in-the-wild exploitation
- Pass-through endpoint URL validation gap enables post-auth cloud credential theft
- Products
- LiteLLMModel Context Protocol
- Organizations
- DEF CON
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-59821 | LiteLLM: LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the… | 2.1 | <1% | ||
| CVE-2026-59822 | Unauthenticated MCP Endpoint Authentication Bypass in BerriAI LiteLLM | 8.8 | <1% | KEV | KEV |
From the original article
11 min read at wiz.io
How default keys, unauthenticated MCP sessions, and custom code guardrails expose cloud AI infrastructure to root-level remote code execution and IAM theft.
By Amitai Cohen · wiz.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.