Hackers Can Turn Vulnerable LiteLLM AI Gateways Into Root Access and Cloud Credential Theft
Wiz found multiple LiteLLM AI gateway flaws, including a CVE-2026-59822 MCP auth bypass added to CISA KEV, enabling root code execution and cloud credential theft.
An internet scan of 3,074 exposed LiteLLM instances found 294 (9.6%) accepting the default sk-1234 master key and 191 (6.2%) requiring no authentication. CVE-2026-59822 lets a single-character Bearer token establish a valid MCP session via an OAuth2 fallback in versions before 1.84.0; the flaw is in CISA's Known Exploited Vulnerabilities catalog. CVE-2026-59821 allows Python code execution as root in the gateway container via unsanitized Custom Code Guardrails registration before 1.82.0-stable, and CVE-2026-35029 permits config changes leading to RCE and admin takeover. Admin access plus pass-through endpoints can reach cloud metadata services to steal IAM credentials.
- 9.6% of exposed LiteLLM gateways accept default sk-1234 master key
- CVE-2026-59822 MCP bypass added to CISA KEV, exploited in the wild
- Guardrails flaw yields root code execution inside gateway container
- Pass-through endpoints can target EC2 IMDS to steal IAM credentials
- Upgrade to 1.84.0+ and replace default keys with strong unique keys
- Products
- LiteLLM
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-35029 | Broken Access Control in LiteLLM AI Gateway Enables Authenticated RCE | 8.7 | 25% | ||
| CVE-2026-59821 | LiteLLM: LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the… | 2.1 | <1% | ||
| CVE-2026-59822 | Unauthenticated MCP Endpoint Authentication Bypass in BerriAI LiteLLM | 8.8 | <1% | KEV | KEV |
From the original article
3 min read at gbhackers.com
Nearly one in 10 internet-exposed LiteLLM AI gateways accepted the widely documented default master key, sk-1234, or required no authentication, creating a direct path to LLMjacking, sensitive credential exposure, and in vulnerable versions root-level code execution inside the gateway container. Their internet scan of 3,074 publicly reachable instances found that 294 systems, or 9. 6%, accepted […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.